Lawsuit filed against Kochava, an Idaho-based data broker, for selling sensitive and precise geolocation data

The Federal Trade Commission (FTC) of the United States said today that it has launched a complaint against Kochava, an Idaho-based data broker, for selling sensitive and precise geolocation data (in meters) gathered from hundreds of millions of mobile devices.

Kochava’s clients, according to the consumer protection watchdog, could use this data to identify and track mobile users’ movements to and from various locations such as reproductive health, mental health, and addiction recovery facilities, shelters for domestic violence survivors, or the homeless.

After paying a $25,000 subscription fee, the company provides access to consumers’ location data via a data stream that clients can access via internet data marketplaces (a free sample dataset was also available until June 2022, containing info collected over the previous seven days).

According to the complaint [PDF], Kochava advertised its data feed on the Amazon Web Services (AWS) Marketplace to its clients as capable of providing “rich geo data spanning billions of devices globally.”

According to the data broker, its location data feed “delivers raw latitude/longitude data with volumes of about 94B+ geo transactions per month, 125 million monthly active users, and 35 million daily active users, on average observing more than 90 daily transactions per device.”

“The FTC contends that by selling data tracking people, Kochava allows others to identify individuals and exposes them to dangers of stigma, stalking, discrimination, job loss, and even physical assault,” the agency said in a press release today.

“In fact, in some marketing materials, the data broker has advertised identifying households as one of the conceivable uses of its data.”

The FTC’s complaint aims to prevent Kochava’s sale of sensitive geolocation data and to compel the company to destroy the sensitive geolocation data it has accumulated.”

“Privacy Block”

Today’s announcement comes after the location data broker sued the FTC earlier this month for overreaching (complaint filed on August 12 is accessible here).

To address the privacy concerns raised by the FTC, Kochava said in a press release (issued one day before filing the complaint) that it will implement “Privacy Block,” a “privacy-first strategy to blocking health care locations from the Kochava Collective marketplace.”

The FTC said earlier this month that it is looking into new laws to crack down on corporations that use mass commercial surveillance to collect, analyze, and monetize customer data.
In July, the agency also warned firms that it would enforce the law if they shared or improperly used highly sensitive information about consumers, including health information.
“Where individuals seek health care, receive therapy, or celebrate their faith is private information that should not be sold to the highest bidder,” said Samuel Levine, Director of the Federal Trade Commission’s Bureau of Consumer Protection.
“The FTC is suing Kochava to preserve people’s privacy and prevent the selling of sensitive geolocation data.”