On August 29, 2022, the Federal Trade Commission (“FTC”) filed a complaint against Kochava, Inc. (“Kochava”), a digital marketing and analytics firm, in the United States District Court for the District of Idaho for alleged acquisition and acquisition. filed a lawsuit. Selling consumers’ “precise geolocation data” in a form that allows users to track their entry into and exit from “sensitive places” such as reproductive health facilities, mental health facilities and places of worship.[i] The complaint states that the sale of such data could expose consumers to “stigma, discrimination, physical violence, emotional distress, and other harm” and therefore constitutes “unjustifiable under Section 5 of the FTC Act.” It claims to be an “act”.[ii]

The complaint’s characterization of Kochava’s collection and sale of geolocation data as an “unfair business practice” reflects a divergence from previous FTC enforcements related to data collection and disclosure practices, and such The focus was primarily on whether certain practices were improperly disclosed to consumers. Lack of consent, hence “deceptive”. In a recent statement, Chairman Rina Khan called for her FTC rulemaking and enforcement to impose “substantial limits” on certain categories of data collection and processing, rather than just imposing “procedural protections.” expressed support for[iii] Kochava’s complaints seem consistent with this new approach.

The FTC’s priorities and perspectives in the area of ​​data privacy and security may be further revealed at the Commission’s Commercial Oversight and Data Security Public Forum on September 8, 2022. Seek public comment in anticipation of new rulemaking related to data privacy and security.

important point

• The complaint against Kochava departs from previous enforcement actions in this area by alleging that certain data collection and disclosure practices in the digital advertising industry are materially “unfair.” .
• A recent statement by Chairman Khan expressed support for FTC enforcement efforts to impose “substantial limits on certain types of data collection and processing,” citing allegations of harm resulting from the disclosure of geolocation data. The focus of the complaint suggests that it may foresee further FTC enforcement and rulemaking to limit collection and disclosure. of a particular category of data.

Complaint

The FTC complaint alleges that Kochava “sells customized data feeds to customers to assist, among other things, in analyzing advertising and foot traffic in stores and elsewhere.”[iv] Among other categories of data, it claims that data feeds purported to contain hundreds of millions of mobile devices contain “time-stamped latitude and longitude coordinates indicating the location of mobile devices.” increase. mobile device” (referred to in the Complaint as a “device ID” or “mobile advertising ID”).[v]

The complaint further states that data provided by Kochava may be used to identify users or owners of mobile devices, including through the use of third-party services that match mobile advertising IDs to user names or addresses. Therefore, it claims that it is not anonymized. Guess the user’s address using the timestamp associated with the user’s location. As a result, the complaint states that the data may be transferred to and from “sensitive locations,” such as those “related to medical care, reproductive health, religious worship, mental health, temporary shelter, etc.” It claims that it could be used to “track the movement of Shelters for homeless, domestic violence survivors, or other at-risk people, and addiction recovery. “[vi] According to the FTC, this tracking can expose consumers to “stigma, discrimination, physical violence, emotional distress, and other harm.”[vii]

The complaint alleges a single claim for violations of Section 5, 15 USC 45(a), (n) of the FTC Act. The complaint seeks a permanent injunction against the company “to prevent future violations of FTC law.”[viii]

The complaint was filed just two weeks after Kochava filed its own lawsuit against the FTC. It argues that the FTC has no authority to bring this lawsuit and the Commission is trying to prevent it from doing so.[ix] The Kochava lawsuit follows receipt of a proposed complaint from the FTC, which may have accelerated the filing of the complaint with the FTC. In the lawsuit, Kochava alleged that it obtained geolocation data from third-party app developers who obtained that information from consenting consumers.[x]

observation

The FTC’s focus on the “unfairness” of Kochava’s geolocation data collection and sale stands apart from recent enforcement actions in this area. Recent enforcement actions focused on the collection and disclosure of potentially sensitive consumer data under Section 5(a) have generally focused on consumer deception, disclosure and consent.[xi] In these lawsuits, the FTC has generally alleged that companies engage in deceptive practices by failing to properly disclose their data collection or disclosure practices or by misrepresenting those practices.

Here, the complaint alleges that the collection and use of location data is “opaque to consumers, who typically do not know who collects the location data and how it is being used.” does not claim that Kochava deceived consumers. Instead, it claims that Kochava’s collection and sale of location data was “unfair,” and the FTC must prove these practices “caused.”[] Also [are] It may cause serious harm to the consumer that the consumer himself cannot reasonably avoid and which is less important than the interests offset by the consumer or the competition. “[xii] By contrast, to establish a deceptive act or practice, the FTC states that “(1) representations, omissions, or practices … (2) are material and (3) mislead consumers who would act reasonably under the circumstances. It is necessary to prove that there is a possibility that “[xiii] As some have noted, the FTC favors non-deception compared to allegations of deception “because the criteria for proving fraud are more specific and respondents are more likely to succeed.” We face an uphill battle to prove our fairness claims.[xiv] The complaint does not provide details about this theory of liability, but Kochava’s sale of location data “is a way for consumers to be exposed to stigma, discrimination, physical violence, emotional distress, and other harm.” hurt or likely to hurt.” These potential harms are outweighed by the offsetting benefits, as Kochava “was able to implement safeguards to remove data associated with sensitive locations from its data feeds.” . . at a reasonable cost and expenditure of resources. “

The focus of the complaint, which focuses on the material unfairness of data privacy practices, is that the Commission “should approach data privacy and security protections with consideration of material restrictions, not mere procedural protections.” ‘ is consistent with Chairman Khan’s recent proposal.[xv] The FTC lawsuit also comes just days before the Commission hosts a public forum on “Commercial Surveillance and Data Security,” scheduled for September 8, 2022. Through Advance Notice of Proposed Rulemaking (“ANPR”).”[xvi] ANPR seeks comment on a wide range of data privacy and security practices, including “collection, aggregation, analysis, retention, transfer, or monetization of consumer data.” The Sept. 8 forum will undoubtedly reveal his FTC enforcement priorities in the areas of data privacy and security, as well as his approach to cracking down on “commercial surveillance” going forward.