Linkable

Nov 7, 2023

The Federal Trade Commission's newly unsealed privacy complaintagainst mobile data broker Kochava alleges that location data sold by the company is “not anonymized” and is “linked or easily linkable” to individual consumers. “Kochava collects consumers’ precise geolocation information that is obtained from their mobile devices and that is associated with a persistent and individual identifier,” theFTC alleges in its amended complaint , which was filed in June but kept under seal until Friday. “Kochava itself concedes that this data is not anonymous, but rather can be, and is, used to track and identify individual consumers,” the FTC continues. “In many cases, Kochavaprovides data that directly links this precise geolocation data to identifying information about individual consumers, such as names, addresses, email addresses, and phone numbers.” advertisement advertisement Theagency cited Kochava's marketing materials in the amended complaint, writing that Kochava “emphasizes its ability to connect each individual consumer to multiple 'data points' in order to ensurethat its customers are able to continuously track consumers and connect consumers’ activities with historic and new data.” The agency added that Kochava “advertises beingable to connect precise geolocation data with email, demographics, devices, households, and channels.” The FTC also alleged that Kochava “directly links” mobile adidentifiers with other identifying information, such as names, email addresses, home addresses, and phone numbers. The company's marketing materials elaborate that it determines people's homelocations by looking at “the resting lat/lon of a given device between the hours of 10 p.m. and 6 a.m. and omit known business locations,” the FTC alleged. The amended complaintcomes in a lawsuit brought by the FTC last year, when it claimed Kochava engages in an unfair business practice by selling the kind of precise geolocation data that could expose sensitive information,such as whether people visited doctors' offices or religious institutions. Among other allegations, the FTC said Kochava sells precise geolocation data as well as mobile advertising IDs --unique, 32-character identifiers that persist, unless consumers proactively reset them. Kochava countered last year that the data it sells isn't “personally identifiable,” and thatthe agency's allegations -- even if proven true -- wouldn't amount to “unfair” conduct. Kochava specifically argued that practices are only unfair if they violate an established legalpolicy, or are harmful or oppressive. The company added that no current law or regulation prohibits the sale of location data, and such sales don't in themselves harm consumers. In May, U.S.District Court Judge B. Lynn Winmill in Idaho threw out the complaint, ruling that the FTC's allegations, even if proven true, wouldn't show that Kochava created a “significant risk” ofharm to consumers. His ruling allowed the FTC to beef up its allegations and bring the claims again. The FTC did so earlier in June, but filed the revised complaint under seal. Kochava argued the amended complaint should remain sealed, and also sought sanctions against the FTC. Federal procedural rules allow judges to sanction attorneys who file papers that are“frivolous, legally unreasonable, or without factual foundation,” or “brought for an improper purpose.” On Friday, Winmill ordered the amended complaint publiclyreleased, and also rejected Kochava's request for sanctions. “Kochava argues that ten paragraphs in the FTC’s amended complaint contain allegations that are 'knowinglyfalse,'” Winmill wrote. “However, after reviewing each of those allegations, the court cannot identify a single one that appears false or misleading.” While Kochava's motionfor sanctions is itself sealed -- for now -- Winmill describes the company's criticism of the complaint in his new decision. For instance, Kochava took issue with allegations that its sale ofgeolocation data and mobile ad identifiers (shorthanded as MAIDs in the court papers) enabled third parties to track consumers to sensitive locaitons. The company argued that those allegationswere false because it implented a feature that prevents the spread of location data associated with sensitive locations, and because its location data is “anonymized.” But Winmillsaid that Kochava's new feature does not "automatically moot the FTC’s suit for injunctive relief.” He also said he wasn't “persuaded by Kochava’s characterization ofits location data as 'anonymized. '” “The FTC plausibly asserts that, although anonymous on its face, Kochava’s location data is linked to MAIDs in a way that enables thirdparties to identify specific individuals by plotting the coordinates on a map,” he wrote.