On Friday, an Idaho federal court unsealed a Federal Trade Commission (FTC) amended complaint against the Idaho-based data broker Kochava, which the FTC alleges collected and disclosed enormous amounts of sensitive consumer data in violation of federal law.

The FTC filed its first complaint against Kochava in August 2022, which alleged Kochava was acquiring consumers’ precise geolocation data and was selling the data in a format that allowed entities to track consumers’ movements to and from sensitive locations, including but not limited to, medical centers, reproductive healthcare facilities, places of worship, mental health facilities, temporary shelters such as centers for survivors of domestic violence, and other sensitive locations, such as addiction recovery centers.

The FTC said Kochava sold access to its data feeds on online data marketplaces that are publicly accessible. Customers who pay a monthly subscription fee can access its location data feed, and a free sample containing a subset of the data feed was available free of charge, with minimal requirements for accessing the sample and no restrictions on usage. The FTC alleged that Kochava’s business practices cause and are likely to cause substantial injury to consumers, such as allowing individuals to be located who had visited abortion clinics.

The FTC alleged Kochava’s business practices violated Section 5(a) of the FTC Act, 15 U.S.C. § 45(a), which prohibits unfair or deceptive acts or practices in or affecting commerce. Acts or practices under Section 5 of the FTC Act are unfair if they cause or are likely to cause substantial injury to consumers, that consumers cannot reasonably avoid themselves, and that is not outweighed by countervailing benefits to consumers or competition.

Kochava moved to have the initial lawsuit dismissed, and on May 4, 2023, the lawsuit was dismissed by Judge B. Lynn Winmill of the US. District Court for the District of Idaho, as the FTC was determined to have relied too much on the inference that consumers are injured by the data broker’s business practices. The FTC was allowed 30 days to file an amended complaint, as the FTC’s concerns about consumer privacy were found to be legitimate. The amended lawsuit was filed under seal on June 5, 2023, and was three times as long as the initial complaint and ran to 33 pages.

The amended lawsuit includes details about the alleged violations not stated in the first lawsuit. Kochava is alleged to have collected and disclosed precise geolocation data, including details of consumers’ movements, such as visits to sensitive locations. In some cases, geolocation data spans days, months, and even years. In some cases, Kochava linked the geolocation data with other sensitive consumer data, such as name, gender, age, ethnicity, yearly income, marital status, education level, political affiliation, apps installed on users’ mobile devices, interests, behaviors, Mobile Advertising ID, and contact information, which may include address, phone number, and email address.

According to the FTC, the data accessible to Kochava customers allowed individuals to be tracked and served targeted ads. Kochava offered the data in several formats, including a Kochava Collective product, which includes precise geolocation data. This product included granular facts about users, including precise geolocation data, allowing precise targeting of those individuals, and Kochava is alleged to have advertised that product as such.

The FTC alleged the data would allow individuals who received an abortion or were planning on having an abortion to be tracked. The FTC provided an example from the free sample offered by Kochava, which included the data of a woman who visited an abortion clinic. The FTC was able to trace that visit to a mobile device in a single-family residence, and the mobile device was present in the same location three times in one week, allowing the user’s routines to be determined. The FTC alleges that in addition to allowing individuals to be targeted who have sought reproductive care, providers who offer reproductive health services could also be tracked and targeted.

It remains to be seen if the amended lawsuit sufficiently alleges that individuals are likely to suffer substantial injury as a result of Kochava’s business practices, and whether invasion of privacy constitutes an unfair practice under the FTC Act. In the absence of a federal privacy law, the FTC is in the best position to hold companies to account that are determined to have violated consumer privacy. While there have been bipartisan efforts to introduce a federal privacy law, all efforts thus far have failed to get the necessary backing. Earlier this year, three Democratic Senators proposed a bill that would prohibit sensitive health data from being used for advertising purposes. The proposed bill,  The Upholding Protections for Health and Online Location Data (UPHOLD) Privacy Act, sought to prevent data brokers such as Kochava from selling geolocation data and to limit the ability of companies to collect and use personal health information without express consent from consumers.

The post Federal Judge Unseals FTC Amended Complaint Against Kochava appeared first on HIPAA Journal.