FTC Settlement with Kochava
The Federal Trade Commission (FTC) and data broker Kochava have agreed to a settlement that blocks the company and its subsidiary Collective Data Solutions from selling, sharing, or disclosing sensitive location data without consumers' explicit consent. This decision comes after the FTC found Kochava to be illegally obtaining and selling consumers' yearly incomes, mobile device IDs, app usage, and nearly real-time geolocation data within 10 meters, as stated in a 2023 FTC complaint.
The FTC alleged that Kochava sold precise geolocation data showing consumers visiting houses of worship and health care clinics without their consent or awareness, which is a violation of the law barring companies from engaging in unfair and deceptive practices. The FTC initially sued Kochava in August 2022, during the tenure of Biden-appointed chair Lina Khan.
Settlement Terms
The proposed order does not impose a fine on Kochava. However, the settlement requires Kochava to create a sensitive location data program that catalogues sensitive locations to ensure they are not sold or shared. Additionally, the company must establish a "supplier assessment" program to confirm consumers have consented to the collection and use of all location data collected by Kochava and its subsidiary.
Kochava is also required to alert the FTC if it learns that a third party has disclosed consumers' precise location data in violation of the settlement terms. The company must provide consumers with the names of businesses or individuals to which it has sold their precise location data and allow consumers to easily withdraw consent for the sale of their precise locations. Furthermore, Kochava must establish a "data retention schedule" that mandates consumers' data be deleted in a predetermined time frame.
Background and Context
The deal is notable because the Biden FTC took the relatively rare step of waging a court battle with Kochava over its practices. The FTC settlement requirements will have relatively few substantial new effects, as Kochava already agreed to stop sharing or selling sensitive location data as part of a class-action lawsuit settlement in November. As part of that settlement, Kochava also agreed to no longer make money from sales of location data that it gleaned from software development kits contained in apps.
A spokesperson for Kochava stated that the company is "pleased to have reached this proposed settlement and to take this next step toward resolving the FTC matter." The spokesperson added that the settlement "reflects Kochava's ongoing commitment to privacy and responsible data practices, and formalizes the practical safeguards around privacy and compliance."
Implications and Next Steps
Under the settlement deal, Kochava must take several steps to ensure compliance with the terms. The company's commitment to creating an opt-out mechanism allowing consumers to easily delete their data from the company's holdings and place themselves on a list barring future collection and sharing of their information is a significant step towards protecting consumer privacy.
The settlement serves as a reminder of the importance of protecting consumer data and the need for companies to prioritize privacy and responsible data practices. As the use of location data continues to grow, it is essential for companies to ensure that they are handling this sensitive information in a way that respects consumers' rights and complies with relevant laws and regulations.
Source: The Record