• by Wendy Davis  @wendyndavis, February 5, 2024

Siding against mobile data broker Kochava, a federal judge has ruled that the Federal Trade Commission can proceed with a lawsuit alleging the company harmed consumers by selling precise geolocation data.

“The FTC’s claim is legally and factually plausible,” U.S. District Court Judge B. Lynn Winmill in Idaho wrote in a ruling issued Saturday.

He essentially found that the FTC's allegations, if proven true, could support the agency's claim that Kochava engaged in an unfair business practice -- meaning it engaged in activity that could cause “substantial injury” to consumers, and isn't reasonably avoidable or outweighed by benefits.

“Kochava allegedly provides its customers with vast amounts of essentially non-anonymized information about millions of mobile device users’ past physical locations, personal characteristics (including age, ethnicity, and gender), religious and political affiliations, marital and parental statuses, economic statuses, and more,” he wrote.

“This alleged invasion of privacy -- which is substantial both in quantity and quality -- plausibly constitutes a 'substantial injury' to consumers,” he added.

Kochava founder and CEO Charles Manning stated Monday that the company is “confident” it will prevail on the merits.

“Kochava has always operated consistently and proactively in compliance with all rules and laws, including those specific to privacy,” he stated. 

“Never in a million years did we imagine that as a small, law-abiding company we’d find ourselves in the ring on behalf of an entire industry,” Manning added.

The new ruling comes shortly after the FTC announced that two other companies -- Outlogic (formerly X-Mode) and InMarket Media -- agreed to resolve charges that they sold sensitive location data.

Winmill's ruling stems from a lawsuit brought by the FTC in 2022, when it claimed Kochava engages in an unfair business practice by selling the kind of precise geolocation data that could expose sensitive information, such as whether people visited doctors' offices or religious institutions.

Among other allegations, the FTC said Kochava sells precise geolocation data as well as mobile advertising IDs -- unique, 32-character identifiers that persist, unless consumers proactively reset them.

Kochava countered that the data it sells isn't “personally identifiable,” and that the agency's allegations -- even if proven true -- wouldn't amount to “unfair” conduct.

Manning repeated portions of that argument Monday, stating that the FTC's lawsuit represented an attempt by the agency “to make an end-run around Congress to create data privacy law.”

Winmill acknowledged in the ruling that Kochava disputes the FTC's key allegations, but noted that his ruling dealt only with legal issues, not factual disagreements.

In May 2023 Winmill dismissed the FTC's initial complaint, ruling that the allegations, even if proven true, wouldn't show that Kochava created a “significant risk” of harm to consumers. At the time he allowed the FTC to beef up its allegations and bring the claims again.

The FTC did so in June, when it alleged in an amended complaint that in many cases Kochava “provides data that directly links this precise geolocation data to identifying information about individual consumers, such as names, addresses, email addresses, and phone numbers.”

The amended complaint also cited marketing materials that, according to the FTC, highlight Kochava's ability “to connect each individual consumer to multiple 'data points' in order to ensure that its customers are able to continuously track consumers and connect consumers’ activities with historic and new data.”

The FTC additionally alleged that Kochava “directly links” mobile ad identifiers with other identifying information, such as names, email addresses, home addresses, and phone numbers.

The company's marketing materials elaborate that it determines people's home locations by looking at “the resting lat/lon of a given device between the hours of 10 p.m. and 6 a.m. and omit known business locations,” the FTC said in its amended complaint.

Winmill effectively held in his new ruling that the allegations in the amended complaint, if true, could show that Kochava violated consumers' privacy and also exposed them to secondary harms -- such as stigma or emotional distress.

His new ruling points to some specific allegations -- including that Kochava itself “makes inferences about consumers, rather than simply providing raw data from which its customers could make inferences.”

“Those inferences are generally more reliable than inferences drawn solely from geolocation data,” Winmill wrote. “For example, data revealing a device user’s daily use of an app specifically designed to track and manage cancer treatments leaves little to the imagination.”

By contrast, when Winmill dismissed the original complaint he wrote that inferences based solely on raw location data were unreliable. For instance, he wrote last year, geolocation data showing a device user visited an oncology clinic twice in a week could reveal that the user has cancer, or that a friend or family member of the user has cancer.

Manning reiterated Monday that before the FTC sued, Kochava announced a “privacy block” feature that removes known health services locations from its marketplace. He added that Kochava's privacy block “has been blocking over 2.1 million locations from its data products on an ongoing basis.”

Privacy advocate Justin Brookman, director of technology policy at Consumer Reports, cheered Winmill's new opinion upholding the complaint.

“It's a somewhat surprising course correction, but from my perspective, a welcome one,” he said.

He added that a judicial ruling in a contested matter could have a bigger impact on the industry than the voluntary settlements the FTC entered into with InMarket Media and Outlogic.