The Federal Trade Commission sued Kochava, based in Idaho, on Monday, amid a heated debate over the privacy of people seeking abortions in the aftermath of the Supreme Court's decision in June to end constitutional protection for abortion. Although this is not the FTC's first case against a data broker, experts believe it is the first involving health care data and referencing reproductive health clinics.
"This is potentially a big deal," Jeff Chester, executive director of the Center for Digital Democracy, a privacy advocacy group, said of the FTC's action. "They've placed a stake in the ground."
The data-broker industry, which gathers, sells or trades location data from mobile phones, has come under increased scrutiny from Congress and regulators following the Supreme Court decision. Lawmakers have asked the top executives of major tech companies, as well as smaller data brokers, for information about their handling of consumers' location data from mobile phones, and what steps they have taken to protect the privacy rights of individuals seeking information on abortion.
The FTC this month announced it was looking at drafting rules to crack down on what it sees as harmful commercial surveillance and lax data security by tech companies and others.
Stigma, stalking and other risks
In its lawsuit against Kochava filed in federal court in Idaho, the FTC alleges that by selling tracking data, the company enables other parties to identify individuals and exposes them to threats of stigma, stalking, discrimination, job loss and even physical violence. The agency is seeking to halt Kochava's sale of "sensitive geolocation data" and to compel the company to delete the geolocation data it has collected.
“Where consumers seek out health care, receive counseling or celebrate their faith is private information that shouldn't be sold to the highest bidder," said Samuel Levine, Director of the FTC's Bureau of Consumer Protection. "The FTC is taking Kochava to court to protect people's privacy and halt the sale of their sensitive geolocation information."
Representatives of Kochava, based in Sandpoint, Idaho, didn't immediately respond to a request for comment. The company filed a suit against the FTC earlier this month, after the agency sent Kochava a proposed complaint indicating that it could take the company to court.
In its suit, Kochava denied the FTC's allegation that its data can be used to identify people and track them to sensitive locations. The company also maintained that, contrary to the FTC's allegations, it does employ technical controls to prohibit its customers from identifying people or tracking them to sensitive locations.