Cybersecurity Policy Report, FTC Amends Kochava Privacy Complaint to Add Subsidiary, (Jul 16, 2024)

By Tony Foley

The Federal Trade Commission filed an amended second complaint against data broker Kochava that adds a Kochava subsidiary, Collective Data Solutions LLC (CDS), in its ongoing dispute involving alleged violations of the FTC Act regarding the sale of geolocation data.

Background. The FTC’s original complaint against Kochava was filed in August 2022 and alleged that Kochava sold the geolocation data of hundreds of millions of mobile devices that the FTC said could reveal people's visits to reproductive health clinics, places of worship, homeless and domestic violence shelters, and addiction recovery facilities (CPR, Aug. 29, 2022). In May 2023, however, a federal district court judge in Idaho dismissed the complaint, finding that the FTC failed to provide enough evidence that Kochava’s data sales posed a substantial risk to consumers’ privacy (CPR, May 5, 2023). The ruling was without prejudice, however, and the FTC subsequently filed an amended complaint in November 2023, and in February, the Idaho court rejected Kochava’s motion to dismiss the amended complaint (CPR, Feb. 6).

Second amended complaint. The FTC’s second amended complaint, filed in the Idaho court yesterday, makes the same allegations against Kochava as the original, arguing that, by selling the location data of people, the company enabled others to identify individuals and exposed them to various risks, including stalking, discrimination, job loss, and physical violence. The complaint adds, however, that CDS, to which Kochava transferred at least part of its data broker business in July 2023, continues Kochava’s practice of collecting, using, and disclosing large amounts of private and sensitive information about consumers and uses feeds of data by substantially the same third-part data suppliers as Kochava. The FTC maintains that Kochava exerts influence over CDS as its parent company and that CDS provides Kochava with the same types of information outlined in the original complaint. Accordingly, the FTC said that CDS continues to engage in Kochava’s illegal activities in violation of section 5 of the FTC Act.

Holyoak statement. In a concurring statement issued yesterday, FTC Commissioner Melissa Holyoak, a Republican appointed to the commission in March by President Biden, sided with the three Democratic commissioners in supporting the filing of the second amended complaint, agreeing that the complaint adequately alleges a likelihood of substantial injury in the revelation of sensitive locations implicating political, medical, and religious activities.

“For consumers to realize the benefits of technology, they must be able to trust that technology—including tools that hold their sensitive personal data—will remain secure from wrongful government surveillance,” Commissioner Holyoak said. “When private parties like the Defendants disclose precise geolocation information revealing political, medical, or religious activities, without consumers’ consent to willing purchasers, their conduct breaches that trust and jeopardizes Americans’ freedoms.”

News: LitigationEnforcement DataPrivacy FederalLegislation