FTC sues mobile attribution tech startup Kochava for selling location data from hundreds of millions of mobile devices without permission

It’s been a while since we last covered Kochava, a Sandpoint Idaho-based mobile attribution tech startup that helps people-based marketers and optimizes their marketing across connected devices.

In November 2020, we covered Kochava after the startup acquired database maker Thalamus to connect ad buyers and vendors. Over 30,000 registered media buyers use Thalamus to research advertising opportunities, and discover new potential partners. Now, Kochava is making headlines but not for the reasons the company would hope for.

Today, The Federal Trade Commission (FTC) filed suit against Kochava alleging the decade-old startup sold geolocation data from hundreds of millions of mobile devices that could be used to track individuals’ movements from places including reproductive health clinics, domestic violence shelters, and places of worship.

In a news release published on its website, The FTC alleged that by selling data tracking people, Kochava is enabling others to identify individuals and exposing them to threats of stigma, stalking, discrimination, job loss, and even physical violence. The FTC’s lawsuit seeks to halt Kochava’s sale of sensitive geolocation data and require the company to delete the sensitive geolocation information it has collected.

“Where consumers seek out health care, receive counseling, or celebrate their faith is private information that shouldn’t be sold to the highest bidder,” said Samuel Levine, Director of the FTC’s Bureau of Consumer Protection. “The FTC is taking Kochava to court to protect people’s privacy and halt the sale of their sensitive geolocation information.”

According to the FTC, Idaho-based Kochava purchases vast troves of location information derived from hundreds of millions of mobile devices. The information is packaged into customized data feeds that match unique mobile device identification numbers with timestamped latitude and longitude locations. According to Kochava, these data feeds can be used to assist clients in advertising and analyzing foot traffic at their stores and other locations. People are often unaware that their location data is being purchased and shared by Kochava and have no control over its sale or use.

Using data Kochava collected on mobile devices and combining it with public map programs, the FTC found it was possible to infer the identity of the device owner by linking those devices to sensitive locations and tracing them back to single-family homes. The agency claimed that until at least June of this year, Kochava would grant users access to a sample data set of time-stamped location information from 61 million unique mobile devices, with relatively little effort required by the user seeking access to the data.

The agency claims Kochava violated a section of the FTC Act that prohibits unfair deceptive practices in commerce. The agency also claims that Kochava was aware of this potential use, marketing its services on the Amazon Web Services Marketplace with the suggestion of using its information “to map individual devices to households.”

The agency argues in its complaint filed in federal court in Idaho that identification via Kochava’s location data “is likely to injure consumers through exposure to stigma, discrimination, physical violence, emotional distress, and other harms.” It added that Kochava could have installed reasonable safeguards to protect consumer information, like by blacklisting information associated with sensitive locations so that it would not appear in data sets, such as addiction recovery centers, shelters or medical facilities.

“This lawsuit shows the unfortunate reality that the FTC has a fundamental misunderstanding of Kochava’s data marketplace business and other data businesses,” Kochava Collective General Manager Brian Cox said in a statement. “Kochava operates consistently and proactively in compliance with all rules and laws, including those specific to privacy.”

Cox said the company announced a new ability to block location data from sensitive locations prior to the FTC’s lawsuit. He said the company engaged with the FTC for weeks explaining the data collection process and hoped to come up with “effective solutions” with the agency.

“Unfortunately the only outcome the FTC desired was a settlement that had no clear terms or resolutions and redefined the problem into a moving target,” Cox said. “Real progress to improve data privacy for consumers will not be reached through flamboyant press releases and frivolous litigation. It’s disappointing that the agency continues to circumvent the lawmaking process and perpetuate misinformation surrounding data privacy.”

Founded in 2011 by Charles Manning, Kochava is one of the industry leaders in mobile app attribution and mobile app analytics. Through its unified audience platform, Kochava provides precision, real-time omnichannel attribution that helps data-driven marketers measure and optimize their marketing for every customer journey.

Below is a PDF version of the complaint filed against Kochava.