As the Federal Trade Commission begins its legal battle against one of the smaller startups in the ad-tech ocean, some legal and privacy experts are wondering if the agency is taking a new approach to frying fish.
In a new lawsuit against the digital marketing data broker Kochava, the FTC alleges the Idaho-based company sold sensitive consumer geolocation data to companies collected from hundreds of millions of devices. According to the federal agency’s complaint, data collected around sensitive locations — places including reproductive health clinics, places of worship, homeless and domestic violence shelters and addiction recovery centers — could put people at risk of “stigma, discrimination, physical violence, emotional distress, and other harms.”
Since its filing on Monday in federal court in Idaho, the lawsuit has left ad-tech insiders wondering why Kochava was singled out when it’s just one of many data brokers that track location data. Some speculate the regulatory agency wants to make an example out of Kochava without getting overly burdened by suing much larger companies in the ad-tech space. Experts see the lawsuit against a smaller player like Kochava as a warning sign to the broader data broker industry while others say the FTC’s case will be legally challenging and face a high bar. Regardless of the outcome, the legal battle also raises new questions about the future of location-based data — and the appetite advertisers have for it.
Although the FTC has investigated various aspects of the online ad industry — it issued a 2014 report calling on more transparency and accountability for data brokers — the agency has traditionally focused more on giants like internet and telecom companies. The most famous example of FTC enforcement related to data privacy was its landmark settlement with Facebook 2019 following an investigation into how the British firm Cambridge Analytica collected user data. (The FTC declined Digiday’s interview request about its Kochava lawsuit.)
“That’s the most significant part of this: We’re moving down the supply chain,” said Zach Edwards, an independent researcher. “It’s no longer just the Cambridge Analyticas. We’re going a foot deep instead of an inch deep.”
The new complaint comes a week before the FTC will hold its first public hearing as part of the information-gathering process to inform potential new rules regulating “commercial surveillance.” It also comes as Congress considers new federal regulations under the proposed American Data Privacy And Protection Act, which would give the FTC expanded regulatory powers.
“One thing is size, but it’s also their role,” said Jessica Lee, chair of the law firm Loeb & Loeb’s privacy, security and data innovations practice when asked about why the FTC would target Kochava. “If you really want to try to effect change — particularly in this case where the issue is the data feeds that are made available — it might make more sense to come after a company that’s in the supply chain, and that’s really where Kochava is.”
A different kind of case and a rare countersuit
Former FTC officials told Digiday that the agency is taking a different approach from how it’s sought to regulate data privacy with giants such as internet and telecom companies. Instead of trying to prove Kochava has been deceptive — a key tenet in the 2019 case involving Facebook and Cambridge Analytica — the allegations focus on “unfair” practices with user data. Some lawyers say gives the case more legal standing but others note the FTC needs to prove how Kochava’s practices could harm consumers.
Other times the FTC sued companies over privacy include 2021 settlements with the period-tracking app Flo and the ad platform OpenX. Despite the FTC’s recent track record of privacy-related settlements, Kochava has chosen to preemptively fight back. Earlier this month, it filed a countersuit against the FTC claiming the agency has wrongly threatened the company and mischaracterized its business.
In a written statement, Kochava Collective General Manager Brian Cox said the FTC’s lawsuit “shows the unfortunate reality that the FTC has a fundamental misunderstanding of Kochava’s data marketplace business and other data businesses.” He said Kochava recently rolled out new ways to block geolocation data from sensitive locations, adding that the agency’s desired settlement “had no clear terms or resolutions and redefined the problem into a moving target.”
Kochava—which buys precise geolocation data from various third-party vendors—uses the data in two main ways. Along with helping brands measure ad performance based on footfall traffic, it also sells data to other ad-tech companies that then provide targeted data based on location. The company says it vets data brokers it works with, but the FTC claims the data isn’t anonymized and could put consumers at risk of being identified by their devices and other personal information. Even if there are not yet new laws to regulate location-tracking, legal experts say a settlement could have potential repercussions and that similar violations in the future could open the door for further FTC enforcement.
“Real progress to improve data privacy for consumers will not be reached through flamboyant press releases and frivolous litigation,” according to Cox’s statement emailed to Digiday. “It’s disappointing that the agency continues to circumvent the lawmaking process and perpetuate misinformation surrounding data privacy.”
Ruben Schreurs, chief product officer at the media management firm Ebiquity, said the FTC is in some ways creating a “no-fly zone” around the use of sensitive data. Kochava isn’t the largest player, but he thinks a legal win would potentially give the agency “some meat” to showcase before it begins to revamp its data privacy rules in the coming months.
The lawsuit also sheds more light on the location-tracking industry and could help “blow open” a broader discussion about what companies should be allowed to track, according to Joseph Turow, a longtime privacy researcher and professor of media systems and industries at the University of Pennsylvania. However, he said it doesn’t fully address what the agency wants companies to change or how the government should regulate data beyond sensitive topics.
“It really is a question of whether this is an acceptable aspect of society,” Turow said. “And I think the FTC has to confront that.”
The uphill battle
Some former FTC officials who spoke with Digiday have doubts about whether the case could win in court. Megan Gray, a former FTC attorney focused on enforcing privacy who is now CEO of GrayMatters Law and Policy, said she thinks the agency will lose the case based on its merits.
“How this case is understood — which is the agency suing a data broker for selling geo-location data without a sensitive locations filter and without delineating permissible purposes for its customers — that’s new,” she said. “That is on the bleeding edge forefront for privacy perspectives, and a company can genuinely say ‘we didn’t know.’”
Although Gray thinks the FTC’s own case has weaknesses, she said it “rarely makes sense” to file suit against the FTC, especially since the financial penalties are often small and the terms aren’t “particularly onerous.”
Regardless of what happens with Kochava, others suggest companies that sell or share precise geolocation data could also potentially face similar actions. Meanwhile, concerns around abortion-related data since the U.S. Supreme Court overturned Roe v. Wade have also made data privacy a heightened priority at the FTC and across various parts of the Biden administration.
Allison Lefrak — who spent nearly a decade as an attorney at the FTC focused on privacy and identity protection — noted a part of the FTC’s complaint that suggests Kochava should have created a blacklist for locations related to the types of data addressed in the lawsuit. Now senior vice president of public policy and ads privacy at Pixalate, Lefrak said recent actions suggest the agency is indicating an increased interest in going after the “commercial surveillance” industry.
“If I were an ad-tech data broker, I’d get on this blacklist recommendation,” Lefrak said.
More in Marketing
WTF is the CMA — the Competition and Markets Authority
Why does the CMA’s opinion on Google’s Privacy Sandbox matter so much? Stick around to uncover why.
Marketing Briefing: How the ‘proliferation of boycotting’ has marketers working understand the real harm of brand blockades
While the reasons for the boycotts vary, there’s a recognition among marketers now that a brand boycott could happen regardless of their efforts – and for reasons outside of marketing and advertising – that will need to be dealt with.
Temu’s ad blitz exposes DTC turmoil: decoding the turbulent terrain
DTC marketers are pointing fingers at Temu, attributing the sharp surge in advertising costs across Meta’s ad platforms to its ad dollars.