Abortion-tracking fears spur FTC lawsuit against data broker Kochava

The data broker Kochava says the Federal Trade Commission fundamentally misunderstands its business after the regulator sued the company for selling location information that the FTC fears will be used to track people going to abortion clinics and places of worship.

The independent agency, now chaired by one of President Biden’s appointees, sued Kochava in U.S. District Court for the District of Idaho to stop the alleged sale of data on hundreds of millions of devices that the government said could be used to stalk people, discriminate or enable targeted violence.

“Where consumers seek out healthcare, receive counseling, or celebrate their faith is private information that shouldn’t be sold to the highest bidder,” Samuel Levine, director of the FTC’s bureau of consumer protection, said in a statement on Monday.

Kochava said the FTC does not understand its work, and that it has toiled for several weeks to give information to the agency. Kochava Collective general manager Brian Cox said the FTC will not protect people’s data through “flamboyant press releases and frivolous litigation.”

“We hoped to have productive conversations that led to effective solutions with the FTC about these complicated and important issues and are open to them in the future,” Mr. Cox said in a statement. “Unfortunately, the only outcome the FTC desired was a settlement that had no clear terms or resolutions and redefined the problem into a moving target.”

According to the FTC, Kochava packages purchased location data into custom feeds that match unique mobile identification numbers with timestamped latitude and longitude locations. This information then assists Kochava’s clients in advertising and monitoring foot traffic at stores and other locations.

Kochava is hardly the only company using such data. Throughout the COVID-19 pandemic, Google has published “community mobility reports” that monitor people’s movements around the world to grocery stores, parks, offices and other places as people study the virus’s spread.

Google, however, includes a disclaimer in its public reports claiming it uses “world-class anonymization technology” so that the tracked movements are not matched to an individual person.

The FTC’s lawsuit against Kochava makes clear it is worried that the company’s data can allow anyone to follow a woman from an abortion clinic to her home or reveal the people conducting the abortion.

“In fact, in just the data Kochava made available in the Kochava Data Sample, it is possible to identify a mobile device that visited a women’s reproductive health clinic and trace that mobile device to a single-family residence,” the lawsuit said. “The data set also reveals that the same mobile device was at a particular location at least three evenings in the same week, suggesting the mobile device user’s routine.”

Democratic lawmakers are also concerned about the commercial availability of data on women seeking abortions. Three Democrats on the House Committee on Oversight and Reform said last month they were investigating the sale of personal data related to pregnant women seeking abortions.

Alongside abortion clinics, the FTC alleged that the data may also make people attending religious services vulnerable. The agency alleged that Kochava’s data sample identified mobile devices’ locations at Christian, Islamic and Jewish places of worship.

Mr. Cox said he was disappointed that the FTC was perpetuating “misinformation surrounding data privacy” and circumventing the lawmaking process. Before the FTC took legal action, Mr. Cox said, Kochava created a new capability to block geographic data from sensitive locations via a tool called “Privacy Block,” which removes the data from the market.

He said his company is implementing the functionality of the privacy tool.