Nov 24, 2023

The FTC's second attempt to pursue the data broker, Kochava,continues to move forward. The amended complaint, which was justunsealed and thus available for the public to review, gives insightinto the agency's perspective on the harm that results whencompanies create profiles with sensitive information, and use thatinformation to target ads to individuals. The amended complaintprovides more detail about Kochava's alleged practices;allegations the company strongly disagreed with. (Thus, why it sought -unsuccessfully- to have itsealed.) The agency's original complaint from August 2022 focused on thecompany's data selling practices. The complaint alleged Kochavacollected geolocation data from hundreds of millions of mobiledevices and packaged them into "data feeds" for marketingpurposes. Those feeds included personal identifiers like name andaddress. It also included information about gender identity andethnicity. The feeds, the FTC alleged, tracked location informationthat might place people in "sensitive" physicallocations. These included reproductive health clinics, domesticabuse shelters, places of worship, and the like. Those feeds, theFTC noted, are time stamped. Meaning that the time the person(mobile device) was at the location can also be tracked. Notwithstanding these concerns, the case was dismissed in May of this year for failure tostate sufficient harm, with leave to amend. The FTC 's amendedcomplaint was filed in June (but just unsealed), and in it, notsurprisingly, the FTC has expanded its discussion of harm toconsumers. In the original complaint, the FTC's concerns focused on thepotential harm if someone was tracked at a sensitive location, witha potential for discrimination and physical violence. In theamended complaint, the FTC includes harm from the company'salleged collection and use of profiles based on sensitiveinformation gathered from a wide variety of sources. These sources,according to the FTC, include health information from women'sreproductive health apps. The profiles it creates, the FTC furtheralleges, is then sold to third parties. It is then used to marketto individuals based on the sensitive information. For example,targeting ads to "new parents/expecting" or "likelyRepublican voter." Like the initial complaint, the amended complaint alleges thatKochava had no security processes in place for determining whetherto approve a data access request. Nor were there controls in place,according to the FTC, to limit the subsequent use and sale of thedata. Putting it into Practice: While this is far fromsettled, it shows that the FTC is being aggressive in its use ofthe FTC Act to pursue those who create and use consumer profiles.This effort mirrors others in the data broker space,including California's recent DeleteAct , and examination of databrokers by the CFPB. The content of this article is intended to provide a generalguide to the subject matter. Specialist advice should be soughtabout your specific circumstances. Holland & Knight Welcome back to Holland & Knight's monthly data privacy and security news update that includes thelatest in policy, regulatory updates and other significant developments. Manatt, Phelps & Phillips LLP On October 30, President Biden signed a highly anticipated "Executive Order on the Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence" (AI). Ankura Consulting Group LLC This article highlights three incremental requirements in Quebec's new privacy Law 25 that organizations who previously prepared for the EU's General Data Protection Regulation... Arnold & Porter Are you perplexed, concerned, or curious about the rapidly developing state privacy law landscape in the United States? Twelve states have enacted broadly applicable privacy... Holland & Knight A December 2022 bulletin issued by the U.S. Department of Health and Human Services' (HHS) Office for Civil Rights (OCR) has received widespread criticism for...