The HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

FTC Files Amended Complaint Against Kochava for Selling Geolocation Data

In August last year, the Federal Trade Commission (FTC) took legal action against the mobile data broker Kochava alleging the Idaho company had violated consumer privacy and put consumers at risk by selling geolocation data from their mobile phones, which was tied to each individual through the unique ID of their mobile device.

The FTC claimed Kochava sold the data from hundreds of millions of devices which could reveal that consumers had visited sensitive locations such as abortion clinics, mental health clinics, places of worship, and other sensitive locations. Since the information was tied to a user’s mobile device, companies that used Kochava’s data feeds would be able to identify and track specific mobile devices. As an example, the FTC claimed that individuals visiting reproductive health clinics for abortions could be identified, along with the medical professionals that provided those services, and those individuals could be exposed to stigma, discrimination, physical violence, emotional distress, prosecution, or other harms.

On May 4, 2023, a federal District Court Judge dismissed the complaint as the FTC failed to allege that consumers had been put at significant risk of harm, but left the door open for the FTC to continue with its legal action by allowing an amended complaint to be filed within 30 days. The FTC has now filed an amended complaint against Kochava that includes additional facts to support its allegations that Kochava engaged in unfair practices that violated the FTC Act and put consumers at significant risk of harm. The amended complaint includes new factual allegations that the FTC says are based, in part, on materials provided by Kochava in response to its Civil Investigative Demand.

The FTC has filed a motion to temporarily file the amended complaint under seal, as while the FTC does not believe any of the information detailed in the amended complaint reveals any trade secrets or other material that it believes should be subject to confidential treatment, the FTC anticipates Kochava may object to the public disclosure of that material. When the material was provided to the FTC, Kochava marked it as ‘proprietary’ and ‘highly confidential’. The FTC said it is acting “out of an abundance of caution,” and in accordance with internal rules covering the disclosure of proprietary and trade secret information by requesting the complaint be sealed until such point that the court decides that the material is not subject to confidential treatment.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

Kochava sought to have the initial complaint dismissed and is expected to file a motion to also have the FTC’s amended complaint dismissed. Kochava continues to maintain the company has proactively complied with all appropriate laws and has not violated consumer privacy.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered in The HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has 10 years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics. Steve shapes the editorial policy of The HIPAA Journal, ensuring its comprehensive coverage of critical topics. Steve Alder is considered an authority in the healthcare industry on HIPAA. The HIPAA Journal has evolved into the leading independent authority on HIPAA under Steve’s editorial leadership. Steve manages a team of writers and is responsible for the factual and legal accuracy of all content published on The HIPAA Journal. Steve holds a Bachelor’s of Science degree from the University of Liverpool. You can connect with Steve via LinkedIn or email via stevealder(at)hipaajournal.com

x

Is Your Organization HIPAA Compliant?

Find Out With Our Free HIPAA Compliance Checklist

Get Free Checklist