Class Action vs. Kochava Mirrors Privacy Allegations in FTC Complaint

Kochava violates consumer protection laws by acquiring consumers' precise geolocation data and selling it “in a format that allows entities to track the consumers' movements to and from sensitive locations,” alleged King County, Washington, plaintiff Cindy Murphy in a class action Wednesday (docket 2:23-cv-00058) in U.S. District Court for Idaho. Her complaint bears strong similarities to the FTC’s Aug. 29 lawsuit in which the agency seeks a permanent injunction enjoining Kochava from acquiring the data (see 2212050061).

Kochava is “a location data broker” that gives its customers “massive amounts of precise geolocation data collected from consumers' mobile devices,” said Murphy’s complaint. Kochava collects “a wealth of information about consumers” and their mobile devices by buying data from other data brokers to sell to its own customers, it said. Kochava then sells “customized data feeds” to its clients to assist in advertising and analyzing foot traffic at stores or other locations, it said.

Kochava has sold access to its data feeds on publicly accessible online data marketplaces, said Murphy’s complaint. It typically charges a monthly subscription fee of thousands of dollars to access its location data feed but also offered a free sample, called the Kochava data sample, which is “publicly available with only minimal steps and no restrictions on usage,” it said.

Precise geolocation data associated with “unique identifiers” called mobile advertising IDs can be used “to track consumers to sensitive locations, including places of religious worship, places that may be used to infer an LGBTQ+ identification, domestic abuse shelters, medical facilities, and welfare and homeless shelters,” said Murphy’s complaint. By plotting the latitude and longitude coordinates included in the Kochava data stream using publicly available map programs, for example, “it is possible to identify which consumers' mobile devices visited reproductive health clinics,” it said. “Because each set of coordinates is time-stamped, it is also possible to identify when a mobile device visited the location.”

The data may be used to identify consumers who have visited an abortion clinic and “may have had or contemplated having an abortion,” said Murphy’s complaint. In the data Kochava makes available in the free data sample, “it is possible to identify a mobile device that visited a women's reproductive health clinic and trace that mobile device to a single-family residence,” it said. “The data set also reveals that the same mobile device was at a particular location at least three evenings in the same week, suggesting the mobile device user's routine.” The data may also be used to identify medical professionals “who perform, or assist in the performance, of abortion services,” it said.

Murphy and her proposed class members seek an order enjoining Kochava from engaging in the unfair business practices described in her complaint. She also seeks an order requiring Kochava to pay restitution “to restore all funds acquired by means of any act or practice” declared by the court “to be an unlawful, unfair, or fraudulent business act or practice,” said the complaint. Kochava didn’t comment.