FTC sues data broker Kochava for tracking geolocation of health clinics

The Federal Trade Commission sued app analytics firm Kochava for selling sensitive geolocation data, including details that could unmask people seeking or performing abortions.

The lawsuit claims that Kochava failed to add basic privacy protections to its location data, much of which is collected from phones without the owners’ knowledge. “Kochava data can reveal people’s visits to reproductive health clinics, places of worship, homeless and domestic violence shelters, and drug rehabilitation centers,” the FTC said in a press release. . “By selling people-tracking data, Kochava enables others to identify individuals and expose them to threats of stigma, harassment, discrimination, job loss, and even physical violence.” The agency is asking Kochava to stop selling sensitive data and delete all collected information.

The lawsuit follows a promise by the FTC to crack down on the sharing of medical location data, a widespread problem that became particularly difficult after the disappearance of Roe vs. Wade. Points of sale, including Motherboard, reported that data brokers were selling cheap access to geolocation data around reproductive health clinics, which could compromise visitors’ privacy and expose them to harassment or legal action. Following pressure from Sen. Elizabeth Warren (D-MA) and others, data brokers SafeGraph and Placer.ai pledged to end the practice, and Google said it would automatically remove visits to clinics and other sensitive places.

But the FTC says Kochava has made it easy, and in some cases free, to find sensitive data. While the company’s services typically cost thousands of dollars, it also offers a free trial with “minimal steps and no usage restrictions.” According to the complaint, this sample allowed the FTC to identify a visitor to a women’s reproductive health clinic and then link it to a home address that would likely expose the visitor’s identity. In another case, he identified a phone whose owner spent the night at a shelter for at-risk pregnant women or new mothers. The agency is asking Kochava to add safeguards around sensitive locations, which it says could be done at a “reasonable” cost.

Kochava disputed the allegations in a statement. “Kochava operates consistently and proactively in compliance with all rules and laws, including those specific to privacy,” said chief executive Brian Cox. “Over the past few weeks, Kochava has worked to educate the FTC about the role of data, the process by which it is collected, and how it is used in digital advertising. We hoped to have productive conversations that led to effective solutions with the FTC on these complex and important issues and we look forward to them in the future. Unfortunately, the only outcome the FTC wanted was a settlement that had no clear terms or resolutions and reframed the problem as a moving target.

Updated August 29, 5:45 p.m. ET: Added statement from Kochava.