Case 2:22-cv-00377-DCN Document 1 Filed 08/29/22 Page 1 of 11
`
`BRIAN SHULL, IL Bar No. 6293797
`JULIA A. HORWITZ, DC Bar No. 1018561
`Federal Trade Commission
`600 Pennsylvania Avenue, N.W.
`Washington, D.C. 20580
`Phone: (202) 326-3734
`Fax: (202) 326-3062
`bshull@ftc.gov
`jhorwitz@ftc.gov
`
`ATTORNEYS FOR PLAINTIFF
`
`UNITED STATES DISTRICT COURT
`FOR THE DISTRICT OF IDAHO
`
`FEDERAL TRADE COMMISSION,
`
`Case No. 2:22-cv-377
`
`Plaintiff,
`
`v.
`
`KOCHAVA INC., corporation,
`
`Defendant.
`
`COMPLAINT FOR PERMANENT
`INJUNCTION AND OTHER
`RELIEF
`
`Plaintiff, the Federal Trade Commission (“FTC”), for its Complaint alleges:
`
`1.
`
`The FTC brings this action under Section 13(b) of the Federal Trade Commission
`
`Act (“FTC Act”), 15 U.S.C. § 53(b), which authorizes the FTC to seek, and the Court to order,
`
`permanent injunctive relief and other relief for Defendant’s acts or practices in violation of
`
`Section 5(a) of the FTC Act, 15 U.S.C. § 45(a). Defendant’s violations are in connection with
`
`acquiring consumers’ precise geolocation data and selling the data in a format that allows entities
`
`to track the consumers’ movements to and from sensitive locations, including, among others,
`
`locations associated with medical care, reproductive health, religious worship, mental health,
`
`1
`
`
`
`BRIAN SHULL, IL Bar No. 6293797
`JULIA A. HORWITZ, DC Bar No. 1018561
`Federal Trade Commission
`600 Pennsylvania Avenue, N.W.
`Washington, D.C. 20580
`Phone: (202) 326-3734
`Fax: (202) 326-3062
`bshull@ftc.gov
`jhorwitz@ftc.gov
`
`ATTORNEYS FOR PLAINTIFF
`
`UNITED STATES DISTRICT COURT
`FOR THE DISTRICT OF IDAHO
`
`FEDERAL TRADE COMMISSION,
`
`Case No. 2:22-cv-377
`
`Plaintiff,
`
`v.
`
`KOCHAVA INC., corporation,
`
`Defendant.
`
`COMPLAINT FOR PERMANENT
`INJUNCTION AND OTHER
`RELIEF
`
`Plaintiff, the Federal Trade Commission (“FTC”), for its Complaint alleges:
`
`1.
`
`The FTC brings this action under Section 13(b) of the Federal Trade Commission
`
`Act (“FTC Act”), 15 U.S.C. § 53(b), which authorizes the FTC to seek, and the Court to order,
`
`permanent injunctive relief and other relief for Defendant’s acts or practices in violation of
`
`Section 5(a) of the FTC Act, 15 U.S.C. § 45(a). Defendant’s violations are in connection with
`
`acquiring consumers’ precise geolocation data and selling the data in a format that allows entities
`
`to track the consumers’ movements to and from sensitive locations, including, among others,
`
`locations associated with medical care, reproductive health, religious worship, mental health,
`
`1
`
`
`
`Case 2:22-cv-00377-DCN Document 1 Filed 08/29/22 Page 2 of 11
`
`temporary shelters, such as shelters for the homeless, domestic violence survivors, or other at-
`
`risk populations, and addiction recovery.
`
`JURISDICTION AND VENUE
`
`2.
`
`This Court has subject matter jurisdiction pursuant to 28 U.S.C. §§ 1331, 1337(a),
`
`and 1345.
`
`3.
`
`Venue is proper in this District under 28 U.S.C. § 1391 (b)(1), (b)(2), and (c)(2)
`
`and 15 U.S.C. § 53(b).
`
`PLAINTIFF
`
`4.
`
`The FTC is an independent agency of the United States Government created by
`
`the FTC Act, which authorizes the FTC to commence this district court civil action by its own
`
`attorneys. 15 U.S.C. §§ 41–58. The FTC enforces Section 5(a) of the FTC Act,
`
`15 U.S.C. § 45(a), which prohibits unfair or deceptive acts or practices in or affecting commerce.
`
`DEFENDANT
`
`5.
`
`Defendant Kochava Inc. (“Kochava”) is a Delaware corporation with its principal
`
`place of business at 201 Church Street, Sandpoint, Idaho 83864. Kochava transacts or has
`
`transacted business in this District and throughout the United States.
`
`COMMERCE
`
`6.
`
`At all times relevant to this Complaint, Defendant has maintained a substantial
`
`course of trade in or affecting commerce, as “commerce” is defined in Section 4 of the FTC Act,
`
`15 U.S.C. § 44.
`
`DEFENDANT’S BUSINESS ACTIVITIES
`
`Kochava Sells Precise Location Information for Hundreds of Millions of Mobile Devices
`
`
`
`2
`
`
`
`Case 2:22-cv-00377-DCN Document 1 Filed 08/29/22 Page 3 of 11
`
`7.
`
`Kochava is, among other things, a location data broker that provides its customers
`
`massive amounts of precise geolocation data collected from consumers’ mobile devices.
`
`Through Kochava’s services, customers can “[l]icense premium data” including the “precision
`
`location” of a consumer’s mobile device.
`
`8.
`
`Kochava collects a wealth of information about consumers and their mobile
`
`devices by, among other means, purchasing data from other data brokers to sell to its own
`
`customers.
`
`9.
`
`Kochava then sells customized data feeds to its clients to, among other purposes,
`
`assist in advertising and analyzing foot traffic at stores or other locations. Among other
`
`categories, Kochava sells timestamped latitude and longitude coordinates showing the location of
`
`mobile devices. For example, in the Amazon Web Services (“AWS”) Marketplace, a website
`
`through which customers could subscribe to Kochava’s data feed until approximately June 2022,
`
`Kochava displayed the following table explaining the data it sells:
`
`
`
`10.
`
`As noted in Kochava’s explanation, each pair of timestamped latitude and
`
`longitude coordinates is associated with a “device_id_value,” which is also known as a Mobile
`
`Advertising ID (“MAID”). A MAID is a unique identifier assigned to a consumer’s mobile
`3
`
`
`
`
`
`Case 2:22-cv-00377-DCN Document 1 Filed 08/29/22 Page 4 of 11
`
`device to assist marketers in advertising to the consumer. Although a MAID may be changed
`
`by a consumer, doing so requires the consumer to proactively reset the MAID on the consumer’s
`
`mobile device.
`
`11.
`
`In describing its product in the online marketplace, Kochava has asserted that it
`
`offers “rich geo data spanning billions of devices globally.” It has further claimed that its
`
`location data feed “delivers raw latitude/longitude data with volumes around 94B+ geo
`
`transactions per month, 125 million monthly active users, and 35 million daily active users, on
`
`average observing more than 90 daily transactions per device.”
`
`Kochava Provides Public Access to Consumers’ Location Data
`
`12.
`
`Kochava has sold access to its data feeds on online data marketplaces that are
`
`publicly accessible. Kochava typically charges a monthly subscription fee of thousands of
`
`dollars to access its location data feed but has also offered a free sample (the “Kochava Data
`
`Sample”). Kochava has made the Kochava Data Sample publicly available with only minimal
`
`steps and no restrictions on usage.
`
`13.
`
`For example, the Kochava Data Sample was available on the AWS Marketplace
`
`until approximately June 2022. In order to access the Kochava Data Sample on the AWS
`
`Marketplace, a purchaser needed a free AWS account. A purchaser would then search the AWS
`
`marketplace for “Kochava,” which resulted in two available datasets appearing – a $25,000
`
`location data feed subscription and the Kochava Data Sample.
`
`14.
`
`The Kochava Data Sample consisted of a subset of the paid data feed, covering a
`
`rolling seven-day period. It was formatted as a text file, which could be converted into a
`
`spreadsheet. Put into a spreadsheet, one day of the Kochava Data Sample contained over
`
`
`
`4
`
`
`
`Case 2:22-cv-00377-DCN Document 1 Filed 08/29/22 Page 5 of 11
`
`327,480,000 rows and 11 columns of data, corresponding to over 61,803,400 unique mobile
`
`devices.
`
`15. When an AWS purchaser clicked on the “subscribe” button for the Kochava Data
`
`Sample feed, the purchaser was directed to a screen that included a “Subscription terms”
`
`notification that stated that the Kochava Data Sample “has been marked by the provider [i.e.,
`
`Kochava] as containing sensitive categories of information:”
`
`
`
`
`
`16.
`
`Below this notice, a form was displayed, requesting the purchaser’s company
`
`name, name of the purchaser, email address, and intended use case:
`
`
`
`5
`
`
`
`
`
`Case 2:22-cv-00377-DCN Document 1 Filed 08/29/22 Page 6 of 11
`
`17.
`
`A purchaser could use an ordinary personal email address and describe the
`
`intended use simply as “business.” The request would then be sent to Kochava for approval.
`
`Kochava has approved such requests in as little as 24 hours.
`
`18.
`
`Once Kochava approved the request, the purchaser was notified by email and then
`
`gained access to the data, along with a data dictionary explaining the categories of data provided.
`
`19.
`
`The Kochava Data Sample included precise location data gathered in the seven
`
`days prior to the date Kochava approved the subscription request.
`
`Kochava’s Data Can Be Used to Identify People and Track Them to Sensitive Locations
`
`20.
`
`Precise geolocation data associated with MAIDs, such as the data sold by
`
`Kochava, may be used to track consumers to sensitive locations, including places of religious
`
`worship, places that may be used to infer an LGBTQ+ identification, domestic abuse shelters,
`
`medical facilities, and welfare and homeless shelters. For example, by plotting the latitude and
`
`longitude coordinates included in the Kochava data stream using publicly available map
`
`programs, it is possible to identify which consumers’ mobile devices visited reproductive health
`
`clinics. Further, because each set of coordinates is time-stamped, it is also possible to identify
`
`when a mobile device visited the location. Similar methods may be used to trace consumers’
`
`visits to other sensitive locations.
`
`21.
`
`The location data provided by Kochava is not anonymized. It is possible to use
`
`the geolocation data, combined with the mobile device’s MAID, to identify the mobile device’s
`
`user or owner. For example, some data brokers advertise services to match MAIDs with
`
`“offline” information, such as consumers’ names and physical addresses.
`
`
`
`6
`
`
`
`Case 2:22-cv-00377-DCN Document 1 Filed 08/29/22 Page 7 of 11
`
`22.
`
`Even without such services, however, location data can be used to identify people.
`
`The location data sold by Kochava typically includes multiple timestamped signals for each
`
`MAID. By plotting each of these signals on a map, much can be inferred about the mobile
`
`device owners. For example, the location of a mobile device at night likely corresponds to the
`
`consumer’s home address. Public or other records may identify the name of the owner or
`
`resident of a particular address. Indeed, Kochava has recognized that its data may be used to
`
`track mobile devices to home addresses. In its marketing on the AWS Marketplace, it has
`
`suggested “Household Mapping” as a potential use case of the data:
`
`
`
`23.
`
`Kochava employs no technical controls to prohibit its customers from identifying
`
`consumers or tracking them to sensitive locations. For example, it does not employ a blacklist
`
`that removes from or obfuscates in its data set location signals around sensitive locations
`
`including, among others, locations associated with medical care, reproductive health, religious
`
`worship, mental health, temporary shelters, such as shelters for the homeless, domestic violence
`
`survivors, or other at-risk populations, and addiction recovery.
`
`Kochava’s Practices Cause and Are Likely to Cause Substantial Injury to Consumers
`
`24.
`
`As described above, the data sold by Kochava may be used to identify individual
`
`consumers and their visits to sensitive locations. The sale of such data poses an unwarranted
`
`intrusion into the most private areas of consumers’ lives and causes or is likely to cause
`
`substantial injury to consumers.
`
`
`
`7
`
`
`
`Case 2:22-cv-00377-DCN Document 1 Filed 08/29/22 Page 8 of 11
`
`25.
`
`For example, the data may be used to identify consumers who have visited an
`
`abortion clinic and, as a result, may have had or contemplated having an abortion. In fact, in just
`
`the data Kochava made available in the Kochava Data Sample, it is possible to identify a mobile
`
`device that visited a women’s reproductive health clinic and trace that mobile device to a single-
`
`family residence. The data set also reveals that the same mobile device was at a particular
`
`location at least three evenings in the same week, suggesting the mobile device user’s routine.
`
`The data may also be used to identify medical professionals who perform, or assist in the
`
`performance, of abortion services
`
`26.
`
`As another example, the data could be used to track consumers to places of
`
`worship, and thus reveal the religious beliefs and practices of consumers. In fact, the Kochava
`
`Data Sample identifies mobile devices that were located at Jewish, Christian, Islamic, and other
`
`religious denominations’ places of worship.
`
`27.
`
`As another example, the data could be used to track consumers who visited a
`
`homeless shelter, domestic violence shelter, or other facilities directed to at-risk populations.
`
`This information could reveal the location of consumers who are escaping domestic violence or
`
`other crimes. In addition, because Kochava’s data allows its customers to track consumers over
`
`time, the data could be used to identify consumers’ past conditions, such as homelessness. In
`
`fact, the Kochava Data Sample identifies a mobile device that appears to have spent the night at a
`
`temporary shelter whose mission is to provide residence for at-risk, pregnant young women or
`
`new mothers.
`
`
`
`8
`
`
`
`Case 2:22-cv-00377-DCN Document 1 Filed 08/29/22 Page 9 of 11
`
`28.
`
`As another example, the data could be used to track consumers who have visited
`
`addiction recovery centers. The data could show how long consumers stayed at the center and
`
`whether a consumer relapses and returns to a recovery center.
`
`29.
`
`Identification of sensitive and private characteristics of consumers from the
`
`location data sold and offered by Kochava injures or is likely to injure consumers through
`
`exposure to stigma, discrimination, physical violence, emotional distress, and other harms.
`
`30.
`
`These injuries are exacerbated by the fact that, as described above, Kochava lacks
`
`any meaningful controls over who accesses its location data feed, including the Kochava Data
`
`Sample.
`
`31.
`
`The collection and use of their location data are opaque to consumers, who
`
`typically do not know who has collected their location data and how it is being used. Indeed,
`
`once information is collected about consumers from their mobile devices, the information can be
`
`sold multiple times to companies that consumers have never heard of and never interacted with.
`
`Consumers have no insight into how this data is used – they do not, for example, typically know
`
`or understand that the information collected about them can be used to track and map their past
`
`movements and that inferences about them and their behaviors will be drawn from this
`
`information. Consumers are therefore unable to take reasonable steps to avoid the above-
`
`described injuries.
`
`32.
`
`The harms described above are not outweighed by countervailing benefits to
`
`consumers or competition. Defendant could implement safeguards to remove data associated
`
`with sensitive locations from its data feeds. Such safeguards could be implemented at a
`
`reasonable cost and expenditure of resources.
`
`
`
`9
`
`
`
`Case 2:22-cv-00377-DCN Document 1 Filed 08/29/22 Page 10 of 11
`
`*
`
`*
`
`*
`
`33.
`
`Based on the facts and violations of law alleged in this Complaint, the FTC has
`
`reason to believe that Defendant is violating or is about to violate laws enforced by the
`
`Commission.
`
`VIOLATIONS OF THE FTC ACT
`
`34.
`
`Section 5(a) of the FTC Act, 15 U.S.C. § 45(a), prohibits “unfair or deceptive acts
`
`or practices in or affecting commerce.”
`
`35.
`
`Acts or practices are unfair under Section 5 of the FTC Act if they cause or are
`
`likely to cause substantial injury to consumers that consumers cannot reasonably avoid
`
`themselves and that is not outweighed by countervailing benefits to consumers or competition.
`
`15 U.S.C. § 45(n).
`
`Count I
`
`Unfair Sale of Sensitive Data
`
`36.
`
`In numerous instances, Defendant has sold, licensed, or otherwise transferred
`
`precise geolocation data associated with unique persistent identifiers that reveal consumers’
`
`visits to sensitive locations, including, among others, locations associated with medical care,
`
`reproductive health, religious worship, mental health, temporary shelters, such as shelters for the
`
`homeless, domestic violence survivors, or other at-risk populations, and addiction recovery.
`
`37.
`
`Defendant’s actions cause or are likely to cause substantial injury to consumers
`
`that consumers cannot reasonably avoid themselves and that is not outweighed by countervailing
`
`benefits to consumers or competition.
`
`
`
`10
`
`
`
`Case 2:22-cv-00377-DCN Document 1 Filed 08/29/22 Page 11 of 11
`
`38.
`
`Therefore, Defendant’s acts or practices as set forth in Paragraph 35 constitute
`
`unfair acts or practices in violation of Section 5 of the FTC Act, 15 U.S.C. § 45(a), (n).
`
`CONSUMER INJURY
`
`39.
`
`Consumers are suffering, have suffered, and will continue to suffer substantial
`
`injury as a result of Defendant’s violations of the FTC Act. Absent injunctive relief by this
`
`Court, Defendant is likely to continue to injure consumers and harm the public interest.
`
`
`
`Wherefore, Plaintiff requests that the Court:
`
`PRAYER FOR RELIEF
`
`A.
`
`Enter a permanent injunction to prevent future violations of the FTC Act by
`
`Defendant; and
`
`B.
`
`Award any additional relief as the Court determines to be just and proper.
`
`
`
`
`
`
`
`
`
`
`Dated: August 29, 2022
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`Respectfully submitted,
`
` /s Brian Shull
`
`BRIAN SHULL
`JULIA A. HORWITZ
`Federal Trade Commission
`600 Pennsylvania Avenue, N.W.
`Washington, D.C. 20580
`(202) 326-3734 (Shull)
`(202) 326-2269 (Horwitz)
`bshull@ftc.gov
`jhorwitz@ftc.gov
`
`Attorneys for Plaintiff
`FEDERAL TRADE COMMISSION
`
`11
`
`
Accessing this document will incur an additional charge of $.
After purchase, you can access this document again without charge.
Accept $ Charge
Still Working On It
This document is taking longer than usual to download. This can happen if we need to contact the court directly to obtain the document and their servers are running slowly.
Give it another minute or two to complete, and then try the refresh button.
A few More Minutes ... Still Working
It can take up to 5 minutes for us to download a document if the court servers are running slowly.
Thank you for your continued patience.
This document could not be displayed.
We could not find this document within its docket. Please go back to the docket page and check the link. If that does not work, go back to the docket and refresh it to pull the newest information.
Your account does not support viewing this document.
You need a Paid Account to view this document. Click here to change your account type.
Your account does not support viewing this document.
Set your membership
status to view this document.
With a Docket Alarm membership, you'll
get a whole lot more, including:
- Up-to-date information for this case.
- Email alerts whenever there is an update.
- Full text search for other cases.
- Get email alerts whenever a new case matches your search.
One Moment Please
The filing “” is large (MB) and is being downloaded.
Please refresh this page in a few minutes to see if the filing has been downloaded. The filing will also be emailed to you when the download completes.
Your document is on its way!
If you do not receive the document in five minutes, contact support at support@docketalarm.com.
Sealed Document
We are unable to display this document, it may be under a court ordered seal.
If you have proper credentials to access the file, you may proceed directly to the court's system using your government issued username and password.
Access Government Site
