The Federal Trade Commission (FTC) announced a lawsuit against software company Kochava Monday over the sale of sensitive location data, according to a release.
The FTC alleges that Kochava purchased and sold data that tracked “hundreds of millions of mobile devices” at reproductive health clinics, places of worship, and other sensitive location data.
“The FTC alleges that by selling data tracking people, Kochava is enabling others to identify individuals and exposing them to threats of stigma, stalking, discrimination, job loss, and even physical violence,” the release said. “The FTC’s lawsuit seeks to halt Kochava’s sale of sensitive geolocation data and require the company to delete the sensitive geolocation information it has collected.”
The lawsuit alleges that Kochava’s “data feeds”—organized data that matches “unique mobile device identification numbers with timestamped latitude and longitude locations”—can be purchased by someone with nefarious purposes. The lawsuit alleges that the company’s data feeds combined with public records would be enough to determine someone’s identity and track their specific movements, and that huge swaths of data can be purchased by “anyone with little effort,” according to the FTC. One data sample the FTC examined had timestamped location data from more than 61 million unique mobile devices in one week.
According to the FTC, “Kochava’s sale of geolocation data puts consumers at significant risk. The company’s data allows purchasers to track people at sensitive locations that could reveal information about their personal health decisions, religious beliefs, and steps they are taking to protect themselves from abusers. The release of this data could expose them to stigma, discrimination, physical violence, emotional distress, and other harms.”
The suit follows a promise from the FTC earlier this month to crack down on commercial surveillance practices in the wake of the Supreme Court overturning Roe v. Wade. In May, over 40 lawmakers sent a letter to Google warning that the location data it collects on users could be used to track down abortion seekers, which prompted the tech giant to state it will auto-delete abortion clinic visits from user data.
The complaint against Kochava was filed in the U.S. District Court for the District of Idaho. In a statement obtained by Morning Brew’s Ryan Barwick, Kochava said that: “This lawsuit shows the unfortunate reality that the FTC has a fundamental misunderstanding of Kochava’s data marketplace business and other data businesses,” and said that it had taken measures to remove sensitive data from the marketplace.
