Kochava, an Idaho-based data broker, is currently in a federal lawsuit with the Federal Trade Commission (“FTC”) over the unrestricted sale of precise consumer geolocation data. The case, which comes before the Idaho District Court on February 21, 2023, could redefine the legal bounds of the data-sharing and data-brokering industries. The Kochava case not only aligns with the FTC’s increasing interest in data privacy and cybersecurity, but also serves to further recent federal policy initiatives such as the Biden Administration’s executive order addressing security concerns over the disclosure of sensitive health-related data.
The FTC claims that Kochava’s brokerage of “precise geolocation data” makes it possible to track consumers to sensitive locations such as “places of religious worship … domestic abuse shelters,” and “medical facilities, and … women’s reproductive health clinics.” This intrusion into a consumer’s private life without proper controls over access and use, according to the FTC, constitutes an illegal and unfair business practice.
Kochava, in turn, claims that the FTC’s approach oversimplifies the concept of an unfair business practice. In addition to the three elements that the FTC claims constitute unfair business practices, Kochava argues that the FTC must show that it violated a predicate law or statute, its activities violate public policy, and its conduct is unethical or oppressive.
Kochava filed a motion to dismiss in October 2022, arguing that the FTC failed to satisfy these requirements. Kochava claims that the FTC’s enforcement action violates its procedural due process rights because Kochava did not have fair notice that its activities might constitute unfair business practices. Kochava also argues that the FTC’s interpretation of “unfair business practices” raises several constitutional issues, including the creation of a new law, which is outside the FTC’s constitutional authority
. Finally, Kochava claims that there is not an ongoing harm to remedy with an injunction since the geolocation data at the center of the dispute has not been available for sale since June 2022 and will not be available for purchase in the future.
The case could have significant implications for data privacy and cybersecurity practices. If the court rules in favor of the FTC, data brokers may need to reevaluate their data-sharing practices, implement stricter controls over access and use, and comply with any new regulations that the FTC may promulgate in the future. On the other hand, if Kochava prevails, the FTC may need to adjust its approach to enforcing privacy violations and its definition of “unfair business practices.”
Based on FTC trends, Kochava appears to be on thin ice. Unfair business practices may be, but are not required to be, explicitly defined to be a violation of Section 5 of the FTC Act. For the last 60 years, the Commission has analyzed the following three criteria to determine whether an act or practice violates the prohibition against consumer unfairness: whether the practice offends public policy, whether it is immoral, and whether it causes substantial injury to consumers that the consumers cannot reasonably avoid and the injury is not outweighed by the countervailing benefits to consumers or competition.
