US FTC sues data broker for selling sensitive geolocation data
US consumer protection watchdog the Federal Trade Commission (FTC) has filed a lawsuit against a data broker, which it alleges was selling precise geolocation data harvested from hundreds of millions of phones.
Data broker Kochava, which is headquartered in Idaho, describes itself as "the industry standard for secure, real-time data solutions," and offers to "help people-based marketers establish identity, define and activate audiences, and measure and optimise their marketing across connected devices."
It does this by purchasing geolocation data from mobile devices ("billions of devices globally"), matching it to unique identifiers such as the device's advertiser ID, and cross-matching the information with other lists to build up a detailed picture of individuals' activities and preferences.
The FTC says that by selling geolocation data "Kochava is enabling others to identify individuals and exposing them to threats of stigma, stalking, discrimination, job loss, and even physical violence."
The watchdog is seeking to force Kochava to stop selling sensitive geolocation data and require it to delete such data that it has already collected.
The issue of online tracking and sale of geolocation data has risen up the agenda in the US following the striking down of the Roe vs Wade abortion law by the country's Supreme Court in June.
"Where consumers seek out health care, receive counselling, or celebrate their faith is private information that shouldn't be sold to the highest bidder," said Samuel Levine, director of the FTC's Bureau of Consumer Protection.
"The FTC is taking Kochava to court to protect people's privacy and halt the sale of their sensitive geolocation information."
Privacy laws in the US are generally weaker than their European equivalents. The thrust of the FTC's case is that Kovacha failed to adequately protect its information from public exposure.
"Until at least June 2022, Kochava allowed anyone with little effort to obtain a large sample of sensitive data and use it without restriction," the regulator claimed.
The case follows an announcement by the FTC in July, in which it said it is "committed to fully enforcing the law against illegal use and sharing of highly sensitive data".
Recently, the FTC fined ad exchange OpenX for collecting children's location data without parental consent, and medical analytics firm Flo Health for sharing sensitive information from its period and fertility-tracking app with third parties, including Google and Facebook, despite stating that the data would be kept private.
Kochava has counter-sued the FTC saying it had misinterpreted the nature of its business.