FTC Sues Data Broker Kochava for Selling Sensitive Location Data

The Federal Trade Commission filed a groundbreaking lawsuit today against data broker Kochava, alleging that the company’s sale of geolocation data from hundreds of millions of mobile devices is an unfair and unlawful trade practice. As the complaint explains, Kochava purchases geolocation information derived from mobile devices—often without mobile users’ knowledge—and sells it to clients for use in advertising and customer monitoring.

“Kochava’s data can reveal people’s visits to reproductive health clinics, places of worship, homeless and domestic violence shelters, and addiction recovery facilities,” the FTC writes. “The FTC alleges that by selling data tracking people, Kochava is enabling others to identify individuals and exposing them to threats of stigma, stalking, discrimination, job loss, and even physical violence.” The FTC is seeking a halt to Kochava’s sale of geolocation data and the deletion of the data it has already collected.

EPIC has long sought to establish and reinforce legal protections for geolocation data. In December, EPIC endorsed a letter from 44 U.S. House members calling on the FTC to establish rules against the collection and sale of consumers’ location data. Earlier this month, the FTC announced a rulemaking on commercial surveillance that would cover location tracking. In 2018, EPIC filed a complaint with the FTC highlighting Google’s wrongful collection of users’ location data—a practice that is at the heart of a recent lawsuit by a bipartisan coalition of state attorneys general.