The FTC gets serious about data privacy with new lawsuit

The Federal Trade Commission is suing data analytics firm Kochava, alleging the company sold sensitive geolocation data from hundreds of millions of mobile devices.

The FTC argues that the data could reveal users’ visits to sensitive places, like abortion providers or addiction recovery centers.

It’s the latest step in FTC Chair Lina Khan’s mission to increase government oversight of companies that traffic in consumer data.

Marketplace’s Kimberly Adams recently spoke with Megan Gray, founder and CEO of GrayMatters Law & Policy, to discuss the significance of this case. The following is an edited transcript of their conversation.

Megan Gray: The significance is substantial, the FTC just kicked a big old ant pile. There are a ton of data brokers who are engaged in this marketplace. I would hazard a guess that all of them are shocked by the complaint that this business is impermissible and in violation of the federal code.

Kimberly Adams: But as you mentioned, this is such a common practice. Why this company in particular?

Gray: For that you have to read between the lines in the complaint. Kochava, unlike most other data brokers for geolocation data, failed to do two things. One, black out any geolocation data associated with sensitive locations, such as abortion clinics or medical centers or battered women’s clinics. Two, instead of digging into why a customer was buying a certain segment or access to the database, [they] simply said, “I’m buying it for business purposes.” The FTC seems to think that you need to drill down more: What business purposes? Is it tracking somebody to abortion clinics so that you could show them pro-choice ads while they’re sitting in the waiting room? Or is it business purposes of send people coupons to buy ice cream as they’re walking by a Baskin-Robbins?

Adams: Do you have a sense at this point of which party in this lawsuit has sort of the upper hand in relation to the law or who has a stronger argument in court?

Gray: Kochava. The FTC has two grounds that it can pursue its consumer protection mission — one is deception and one is unfairness. The FTC went after unfairness. And the FTC has to establish actual or substantial likelihood of injury to consumers — not speculative, not emotional distress. Like actual harm, or the likelihood of substantial harm. For example, [if] Kochava sold the data to a nefarious company that was trying to track down vulnerable members of the public for harassment, and the company was likely to be successful in that harassment campaign. That is very difficult to prove, particularly in a data broker case because the data broker does not have a relationship with the consumer, with the “end point.”

Adams: I wonder if in this environment, after the overturning of Roe v. Wade, when there has been so much more attention focused on data tracking and how much information these data brokers have about the movements of people, if that’s actually creating an opening for the FTC to potentially demonstrate that harm?

Gray: It is. It’s not just an opening, though, it’s a requirement. The FTC carries the burden of proof, and it has to establish that. So it’s a bit of a double-edged sword. If the FTC cannot satisfy its burden of proof, which, again, cannot just be speculative, then that could be problematic for the FTC bringing any future cases like this. So what if the FTC fails in this one particular case? The silver lining may be that that is the catalyst to get Congress to enact a substantial federal privacy law.

Adams: That was actually going to be my next question. Congress still has not passed a federal consumer privacy law. What does it mean for movement on the Hill in regards to data privacy, especially leading up to the 2024 election?

Gray: In short, nothing. Right now, there is a privacy bill in Congress. It is not going to go anywhere. The person with the power to move it in the Senate has said, “No deal” because it is not strong enough. And that means it is not going to happen for a while because you’ve got the midterms, everything has to get rejiggered and different committee assignments [will be made], and maybe a privacy bill will be reintroduced next year. But for right now, nothing is going to happen, and the fact that the Federal Trade Commission has filed this case now is not going to cause any ripples on the congressional side of things because the outcome of that case is just not going to be known for quite some time.

Adams: So then what does it tell you about the FTC’s broader, long-term strategy in regards to consumer data privacy that they are pursuing this case?

Gray: That they are not going to back down from a fight, that they are going to stand behind what they believe the law should be. And they have said that these commercial surveillance practices, particularly when they implicate sensitive locations, should be outlawed.

Adams: You know, this is how the internet makes money. How significant would it be to the economy of the internet — and I guess, therefore, the economy of this country — if this way of making money goes away?

Gray: I think you would see some readjustment, but I think the economy would be fine, and in fact, would probably be healthier and more robust. Right now, the internet economy, to the extent that it is built on this sort of tracking, advertising, surveillance, it’s just an unhealthy marketplace, and it will not survive. I think that that adjustment period, you’re gonna see a lot of companies get hit hard for sure because they have not designed alternative revenue sources. We saw this with Facebook, when Apple implemented a technical prohibition on Facebook gathering as much data on Facebook app users on iPhones as they were previously, and it hit Facebook very, very hard financially and they’re still grappling with how to make money in this new world order on iPhones. But they’ll find a way. We saw this with seatbelts and gasoline and new environmental regulations. There is an adjustment period, but we’re not going to be thrust into some new Great Depression because we no longer have a commercial surveillance economy on the internet.

You can read the FTC’s statement about the lawsuit here and Kochava’s response to the lawsuit here.