FTC accuses data broker of selling sensitive location data

Federal Trade Commission on Monday sued Idaho-based Kochava Inc. amid a charged debate over the privacy of individuals who may be seeking an abortion in the wake of the Supreme Court’s ruling in June ending the constitutional protections for abortion. Although it’s not the first case the FTC has brought against a data broker, experts say it is the first one involving health care data and referencing reproductive health clinics.

“This is potentially a big deal,” Jeff Chester, executive director of the Center for Digital Democracy, a privacy advocacy group, said of the FTC’s action. “They’ve placed a stake in the ground.”

The data-broker industry, which gathers, sells or trades location data from mobile phones, has come under increased scrutiny from Congress and regulators following the Supreme Court decision. Lawmakers have asked the top executives of major tech companies, as well as smaller data brokers, for information about their handling of consumers’ location data from mobile phones, and what steps they have taken to protect the privacy rights of individuals seeking information on abortion.

The FTC this month announced it was looking at drafting rules to crack down on what it sees as harmful commercial surveillance and lax data security by tech companies and others.

In its lawsuit against Kochava filed in federal court in Idaho, the FTC alleges that by selling tracking data, the company enables other parties to identify individuals and exposes them to threats of stigma, stalking, discrimination, job loss and even physical violence. The agency is seeking to halt Kochava’s sale of “sensitive geolocation data” and to compel the company to delete the geolocation data it has collected.

“Where consumers seek out health care, receive counseling, or celebrate their faith is private information that shouldn’t be sold to the highest bidder,” said Samuel Levine, Director of the FTC’s Bureau of Consumer Protection. “The FTC is taking Kochava to court to protect people’s privacy and halt the sale of their sensitive geolocation information.”

Representatives of Kochava, based in Sandpoint, Idaho, didn’t immediately respond to a request for comment. The company filed a suit against the FTC earlier this month, after the agency sent Kochava a proposed complaint indicating that it could take the company to court.

In its suit, Kochava denied the FTC’s allegation that its data can be used to identify people and track them to sensitive locations. The company also maintained that, contrary to the FTC’s allegations, it does employ technical controls to prohibit its customers from identifying people or tracking them to sensitive locations.