On August 29, Federal Trade Commission announced they filed a landmark lawsuit against data broker Kochava for “selling geolocation data from hundreds of millions of mobile devices” that can be used to track movements time of individuals to sensitive locations. These include reproductive health clinics, places of worship, rehab centers and shelters for survivors and survivors of domestic violence. Kochava, the FTC alleges, “is allowing others to identify individuals and expose them to threats of stigma, stalking, discrimination, job loss and even physical violence “.
In response, the Idaho-based company claim that it “operates consistently and actively complies with all rules and laws, including privacy-specific ones”. In other words, Kochava relied on the core protection of the data broker playbook: Yes, it’s legal.
But this is like saying you’ve read every book on the subject when all that’s written is a brochure in the waiting room. In a colossal failure of U.S. policymaking — and in many cases, a product of deliberate try arrive destroy or neglect the privacy of marginalized people — The United States generally has weak privacy laws. Very few laws in the US even concern data brokers, let alone restrict their actions. However, the fact that Kochava didn’t break the law doesn’t make its conduct harmless — nor does it make the company immune to lawsuits. The case of the FTC can prove that this type of monitoring, monetization and data mining is one unfair or deceptive business practices, expose the broker to punishment. And it has reasons to get there.
Despite the lack of privacy laws, the FTC can still take companies to court for interesting in “unfair or deceptive acts or practices.” The FTC’s lawsuits against data brokers are not unheard of, but they often focus on acts like facilitate criminal fraud. By suing Kochava for brokering the geolocation data of individuals without their knowledge and putting them at risk, the FTC is effectively leveraging a larger platform to act against harms of data brokerage.
While data brokers and other tech companies (from Experian to financial data broker Yodlee) have blatantly claimed that their data is “…incognito,” Kochova’s billions of data series are no different. The company has provided a mobile advertising ID — allowing marketers to track who’s behind the device — paired with people’s location, making it possible for buyers to “identify users or mobile device owner” as the lawsuit claims. Kochava also puts individuals at risk in a simpler way: If you have someone’s entire location history, you can easily discover their identity. For example, a phone placed on a nightstand between 10 p.m. and 6 a.m. may indicate a home address, just as a phone in the same office building or retail store from 9 p.m. to 5 p.m. can signal the workplace. The FTC says Kochava knows this and is even trying to profit from it — suggesting “Household Map” as a potential data use case on the Amazon Web Services Marketplace, where buyers can can “group devices by time and frequency of stay at shared locations to individually map devices to households.” Selling this information blatantly puts many people at risk. , especially those who are already disadvantaged and vulnerable.
The entire business model of data brokers is premised on collecting, analyzing and secretly selling or monetizing people’s information. Even in the area of location data, companies have meet advertise Americans’ real-time GPS location, quietly survey Opponents of Black Lives Matter to identify individuals, and provided location data to law enforcement agencies like the FBI and Immigration and Customs Enforcement (ICE), without the need for a warrant. Even after the Supreme Court overturned Roe v. Wademultiple data brokers continue sell location data related to abortion clinic visits, some only agreed stopped when urged by the press and members of Congress. Earlier this month, NextMark CEO Joe Pych told Politico, in defense of his own company’s conduct, that “as far as I know, there is no law today prohibiting prenatal mailing lists”. Do these practices go further? domestic violence and intimate partnerallow Unsecured monitoring of overcrowded communitiesor put women and LGBTQ+ people at risk of stalking and physical violenceMany data brokers continue to sell location information.
If tracking data brokers monitor vulnerable communities and claim to not understand the harms of collecting and selling this kind of data, they are either lying or simply don’t care. . If they are secretly collecting the locations of individuals, linking them to people and selling them online — facilitating tracking of people going to churches and mosques, hospitals and health clinics, quirky nightclubs, and anti-policy protests — and say “No Not “legal” defense — they are promoting arguments in bad faith. In a state of constant surveillance and no privacy regulations, legitimacy is not a determining factor in harm.
The agency alleges that Kochava violated the “unfair or deceptive conduct or practice” clause of the FTC Act, as it unfairly sold highly sensitive location information that risked ” substantial injury” to consumers. Individuals, being monitored without fully knowing and understanding surveillance, cannot reasonably avoid these harms on their own. So for all that Kochava claims the FTC is continuing to “disinformation around data privacy”, this case may further reinforce the fact that the broker’s highly sensitive information people are grounds for lawsuits.
As state legislatures have been slow to enact many privacy laws and congressional initiatives on the matter have stalled, with some members even refusing to touch on the harms of privacy. data broker, the FTC’s case may be the country’s best shot. The agency should insist on its case and take every measure to link the sale of location data with outcomes such as tracking, discrimination and other types of data mining; otherwise, this highly sensitive information will remain on the open market and continue to harm millions of Americans.
