• by Wendy Davis  @wendyndavis, May 4, 2023

A federal judge on Thursday dismissed a complaint brought against mobile data broker Kochava by the Federal Trade Commission, which accused the company of engaging in an unfair business practice by allegedly selling consumers' precise location data.

In a 35-page decision, U.S. District Court Judge B. Lynn Winmill in Idaho said the allegations in the FTC's complaint, even if proven true, wouldn't show that Kochava created a “significant risk” of harm to consumers.

The dismissal was without prejudice, meaning that the FTC can beef up its allegations and bring them again.

The ruling comes in a lawsuit brought by the FTC in August, when it alleged that Kochava sold information about people's precise locations -- including data that could reveal visits to sensitive locales.

The agency's complaint included allegations that Kochava's data -- which is obtained from other companies -- can be used to identify "consumers who have visited an abortion clinic and, as a result, may have had or contemplated having an abortion," as well as "medical professionals who perform, or assist in the performance, of abortion services.”

The FTC claimed that Kochava's location data sales were an unfair business practice, and sought an injunction prohibiting the company from engaging in unfair practices.

Kochava urged Winmill to dismiss the lawsuit at an early stage, arguing that the agency's allegations -- even if proven true -- would not show the company had engaged in unfair conduct.

Kochava also argued there were no grounds for an injunction because its “privacy block” feature removes known health-services locations from Kocahva's marketplace. Kochava rolled out that feature shortly before the FTC sued.

The FTC contended in its complaint that Kochava's alleged data sales were unfair for two reasons.

One was that consumers could be subjected to stigma, discrimination, violence or other harms, as a result of their location data being shared with third parties.

The other was that the alleged privacy violation was severe enough in itself to be considered an injury.

Winmill found the FTC's first rationale “plausible,” but said the agency's complaint lacked allegations that consumers had actually been harmed as a result of outside parties obtaining location data.

The judge wrote that the FTC may be able to proceed on that theory by adding new allegations in an amended complaint.

But the judge rejected the FTC's second rationale, at least for now.

“The purported privacy intrusion is not severe enough to constitute 'substantial injury,'” he wrote.

Winmill elaborated that any “private information” stemming from Kochava's data would come from inferences -- which are unreliable.

“For example, geolocation data showing that a device visited an oncology clinic twice in one week could reveal that the device user suffers from cancer,” he wrote. “Or it may instead reveal that the person has a friend or family member who suffers from cancer.”

Winmill also said that information that can be inferred from location data “is generally accessible through other, lawful means.”

“A third party may, for example, observe a person’s movements on public streets and sidewalks as they go to and from home or a medical facility,” he wrote. “A third party may also discover a person’s home address by reviewing publicly accessible property records.”

Kochava CEO Charles Manning stated Thursday that the ruling marked "an important step toward resolving this matter."

"We are encouraged by the fact that the court was receptive to our arguments that the FTC's allegations fall short," he stated, adding that the company complies with all rules and laws, "including those specific to privacy."