`
`BRIAN SHULL, IL Bar No. 6293797
`JULIA A. HORWITZ, DC Bar No. 1018561
`Federal Trade Commission
`600 Pennsylvania Avenue, N.W.
`Washington, D.C. 20580
`Phone: (202) 326-3734
`Fax: (202) 326-3062
`bshull@ftc.gov
`jhorwitz@ftc.gov
`
`ATTORNEYS FOR PLAINTIFF
`
`UNITED STATES DISTRICT COURT
`FOR THE DISTRICT OF IDAHO
`
`FEDERAL TRADE COMMISSION,
`
`Case No. 2:22-cv-377
`
`Plaintiff,
`
`v.
`
`KOCHAVA INC., corporation,
`
`Defendant.
`
`COMPLAINT FOR PERMANENT
`INJUNCTION AND OTHER
`RELIEF
`
`Plaintiff, the Federal Trade Commission (“FTC”), for its Complaint alleges:
`
`1.
`
`The FTC brings this action under Section 13(b) of the Federal Trade Commission
`
`Act (“FTC Act”), 15 U.S.C. § 53(b), which authorizes the FTC to seek, and the Court to order,
`
`permanent injunctive relief and other relief for Defendant’s acts or practices in violation of
`
`Section 5(a) of the FTC Act, 15 U.S.C. § 45(a). Defendant’s violations are in connection with
`
`acquiring consumers’ precise geolocation data and selling the data in a format that allows entities
`
`to track the consumers’ movements to and from sensitive locations, including, among others,
`
`locations associated with medical care, reproductive health, religious worship, mental health,
`
`1
`
`
`
`Case 2:22-cv-00377-DCN Document 1 Filed 08/29/22 Page 2 of 11
`
`temporary shelters, such as shelters for the homeless, domestic violence survivors, or other at-
`
`risk populations, and addiction recovery.
`
`JURISDICTION AND VENUE
`
`2.
`
`This Court has subject matter jurisdiction pursuant to 28 U.S.C. §§ 1331, 1337(a),
`
`and 1345.
`
`3.
`
`Venue is proper in this District under 28 U.S.C. § 1391 (b)(1), (b)(2), and (c)(2)
`
`and 15 U.S.C. § 53(b).
`
`PLAINTIFF
`
`4.
`
`The FTC is an independent agency of the United States Government created by
`
`the FTC Act, which authorizes the FTC to commence this district court civil action by its own
`
`attorneys. 15 U.S.C. §§ 41–58. The FTC enforces Section 5(a) of the FTC Act,
`
`15 U.S.C. § 45(a), which prohibits unfair or deceptive acts or practices in or affecting commerce.
`
`DEFENDANT
`
`5.
`
`Defendant Kochava Inc. (“Kochava”) is a Delaware corporation with its principal
`
`place of business at 201 Church Street, Sandpoint, Idaho 83864. Kochava transacts or has
`
`transacted business in this District and throughout the United States.
`
`COMMERCE
`
`6.
`
`At all times relevant to this Complaint, Defendant has maintained a substantial
`
`course of trade in or affecting commerce, as “commerce” is defined in Section 4 of the FTC Act,
`
`15 U.S.C. § 44.
`
`DEFENDANT’S BUSINESS ACTIVITIES
`
`Kochava Sells Precise Location Information for Hundreds of Millions of Mobile Devices
`
`
`
`2
`
`
`
`Case 2:22-cv-00377-DCN Document 1 Filed 08/29/22 Page 3 of 11
`
`7.
`
`Kochava is, among other things, a location data broker that provides its customers
`
`massive amounts of precise geolocation data collected from consumers’ mobile devices.
`
`Through Kochava’s services, customers can “[l]icense premium data” including the “precision
`
`location” of a consumer’s mobile device.
`
`8.
`
`Kochava collects a wealth of information about consumers and their mobile
`
`devices by, among other means, purchasing data from other data brokers to sell to its own
`
`customers.
`
`9.
`
`Kochava then sells customized data feeds to its clients to, among other purposes,
`
`assist in advertising and analyzing foot traffic at stores or other locations. Among other
`
`categories, Kochava sells timestamped latitude and longitude coordinates showing the location of
`
`mobile devices. For example, in the Amazon Web Services (“AWS”) Marketplace, a website
`
`through which customers could subscribe to Kochava’s data feed until approximately June 2022,
`
`Kochava displayed the following table explaining the data it sells:
`
`
`
`10.
`
`As noted in Kochava’s explanation, each pair of timestamped latitude and
`
`longitude coordinates is associated with a “device_id_value,” which is also known as a Mobile
`
`Advertising ID (“MAID”). A MAID is a unique identifier assigned to a consumer’s mobile
`3
`
`
`
`
`
`Case 2:22-cv-00377-DCN Document 1 Filed 08/29/22 Page 4 of 11
`
`device to assist marketers in advertising to the consumer. Although a MAID may be changed
`
`by a consumer, doing so requires the consumer to proactively reset the MAID on the consumer’s
`
`mobile device.
`
`11.
`
`In describing its product in the online marketplace, Kochava has asserted that it
`
`offers “rich geo data spanning billions of devices globally.” It has further claimed that its
`
`location data feed “delivers raw latitude/longitude data with volumes around 94B+ geo
`
`transactions per month, 125 million monthly active users, and 35 million daily active users, on
`
`average observing more than 90 daily transactions per device.”
`
`Kochava Provides Public Access to Consumers’ Location Data
`
`12.
`
`Kochava has sold access to its data feeds on online data marketplaces that are
`
`publicly accessible. Kochava typically charges a monthly subscription fee of thousands of
`
`dollars to access its location data feed but has also offered a free sample (the “Kochava Data
`
`Sample”). Kochava has made the Kochava Data Sample publicly available with only minimal
`
`steps and no restrictions on usage.
`
`13.
`
`For example, the Kochava Data Sample was available on the AWS Marketplace
`
`until approximately June 2022. In order to access the Kochava Data Sample on the AWS
`
`Marketplace, a purchaser needed a free AWS account. A purchaser would then search the AWS
`
`marketplace for “Kochava,” which resulted in two available datasets appearing – a $25,000
`
`location data feed subscription and the Kochava Data Sample.
`
`14.
`
`The Kochava Data Sample consisted of a subset of the paid data feed, covering a
`
`rolling seven-day period. It was formatted as a text file, which could be converted into a
`
`spreadsheet. Put into a spreadsheet, one day of the Kochava Data Sample contained over
`
`
`
`4
`
`
`
`Case 2:22-cv-00377-DCN Document 1 Filed 08/29/22 Page 5 of 11
`
`327,480,000 rows and 11 columns of data, corresponding to over 61,803,400 unique mobile
`
`devices.
`
`15. When an AWS purchaser clicked on the “subscribe” button for the Kochava Data
`
`Sample feed, the purchaser was directed to a screen that included a “Subscription terms”
`
`notification that stated that the Kochava Data Sample “has been marked by the provider [i.e.,
`
`Kochava] as containing sensitive categories of information:”
`
`
`
`
`
`16.
`
`Below this notice, a form was displayed, requesting the purchaser’s company
`
`name, name of the purchaser, email address, and intended use case:
`
`
`
`5
`
`
`
`
`
`Case 2:22-cv-00377-DCN Document 1 Filed 08/29/22 Page 6 of 11
`
`17.
`
`A purchaser could use an ordinary personal email address and describe the
`
`intended use simply as “business.” The request would then be sent to Kochava for approval.
`
`Kochava has approved such requests in as little as 24 hours.
`
`18.
`
`Once Kochava approved the request, the purchaser was notified by email and then
`
`gained access to the data, along with a data dictionary explaining the categories of data provided.
`
`19.
`
`The Kochava Data Sample included precise location data gathered in the seven
`
`days prior to the date Kochava approved the subscription request.
`
`Kochava’s Data Can Be Used to Identify People and Track Them to Sensitive Locations
`
`20.
`
`Precise geolocation data associated with MAIDs, such as the data sold by
`
`Kochava, may be used to track consumers to sensitive locations, including places of religious
`
`worship, places that may be used to infer an LGBTQ+ identification, domestic abuse shelters,
`
`medical facilities, and welfare and homeless shelters. For example, by plotting the latitude and
`
`longitude coordinates included in the Kochava data stream using publicly available map
`
`programs, it is possible to identify which consumers’ mobile devices visited reproductive health
`
`clinics. Further, because each set of coordinates is time-stamped, it is also possible to identify
`
`when a mobile device visited the location. Similar methods may be used to trace consumers’
`
`visits to other sensitive locations.
`
`21.
`
`The location data provided by Kochava is not anonymized. It is possible to use
`
`the geolocation data, combined with the mobile device’s MAID, to identify the mobile device’s
`
`user or owner. For example, some data brokers advertise services to match MAIDs with
`
`“offline” information, such as consumers’ names and physical addresses.
`
`
`
`6
`
`
`
`Case 2:22-cv-00377-DCN Document 1 Filed 08/29/22 Page 7 of 11
`
`22.
`
`Even without such services, however, location data can be used to identify people.
`
`The location data sold by Kochava typically includes multiple timestamped signals for each
`
`MAID. By plotting each of these signals on a map, much can be inferred about the mobile
`
`device owners. For example, the location of a mobile device at night likely corresponds to the
`
`consumer’s home address. Public or other records may identify the name of the owner or
`
`resident of a particular address. Indeed, Kochava has recognized that its data may be used to
`
`track mobile devices to home addresses. In its marketing on the AWS Marketplace, it has
`
`suggested “Household Mapping” as a potential use case of the data:
`
`
`
`23.
`
`Kochava employs no technical controls to prohibit its customers from identifying
`
`consumers or tracking them to sensitive locations. For example, it does not employ a blacklist
`
`that removes from or obfuscates in its data set location signals around sensitive locations
`
`including, among others, locations associated with medical care, reproductive health, religious
`
`worship, mental health, temporary shelters, such as shelters for the homeless, domestic violence
`
`survivors, or other at-risk populations, and addiction recovery.
`
`Kochava’s Practices Cause and Are Likely to Cause Substantial Injury to Consumers
`
`24.
`
`As described above, the data sold by Kochava may be used to identify individual
`
`consumers and their visits to sensitive locations. The sale of such data poses an unwarranted
`
`intrusion into the most private areas of consumers’ lives and causes or is likely to cause
`
`substantial injury to consumers.
`
`
`
`7
`
`
`
`Case 2:22-cv-00377-DCN Document 1 Filed 08/29/22 Page 8 of 11
`
`25.
`
`For example, the data may be used to identify consumers who have visited an
`
`abortion clinic and, as a result, may have had or contemplated having an abortion. In fact, in just
`
`the data Kochava made available in the Kochava Data Sample, it is possible to identify a mobile
`
`device that visited a women’s reproductive health clinic and trace that mobile device to a single-
`
`family residence. The data set also reveals that the same mobile device was at a particular
`
`location at least three evenings in the same week, suggesting the mobile device user’s routine.
`
`The data may also be used to identify medical professionals who perform, or assist in the
`
`performance, of abortion services
`
`26.
`
`As another example, the data could be used to track consumers to places of
`
`worship, and thus reveal the religious beliefs and practices of consumers. In fact, the Kochava
`
`Data Sample identifies mobile devices that were located at Jewish, Christian, Islamic, and other
`
`religious denominations’ places of worship.
`
`27.
`
`As another example, the data could be used to track consumers who visited a
`
`homeless shelter, domestic violence shelter, or other facilities directed to at-risk populations.
`
`This information could reveal the location of consumers who are escaping domestic violence or
`
`other crimes. In addition, because Kochava’s data allows its customers to track consumers over
`
`time, the data could be used to identify consumers’ past conditions, such as homelessness. In
`
`fact, the Kochava Data Sample identifies a mobile device that appears to have spent the night at a
`
`temporary shelter whose mission is to provide residence for at-risk, pregnant young women or
`
`new mothers.
`
`
`
`8
`
`
`
`Case 2:22-cv-00377-DCN Document 1 Filed 08/29/22 Page 9 of 11
`
`28.
`
`As another example, the data could be used to track consumers who have visited
`
`addiction recovery centers. The data could show how long consumers stayed at the center and
`
`whether a consumer relapses and returns to a recovery center.
`
`29.
`
`Identification of sensitive and private characteristics of consumers from the
`
`location data sold and offered by Kochava injures or is likely to injure consumers through
`
`exposure to stigma, discrimination, physical violence, emotional distress, and other harms.
`
`30.
`
`These injuries are exacerbated by the fact that, as described above, Kochava lacks
`
`any meaningful controls over who accesses its location data feed, including the Kochava Data
`
`Sample.
`
`31.
`
`The collection and use of their location data are opaque to consumers, who
`
`typically do not know who has collected their location data and how it is being used. Indeed,
`
`once information is collected about consumers from their mobile devices, the information can be
`
`sold multiple times to companies that consumers have never heard of and never interacted with.
`
`Consumers have no insight into how this data is used – they do not, for example, typically know
`
`or understand that the information collected about them can be used to track and map their past
`
`movements and that inferences about them and their behaviors will be drawn from this
`
`information. Consumers are therefore unable to take reasonable steps to avoid the above-
`
`described injuries.
`
`32.
`
`The harms described above are not outweighed by countervailing benefits to
`
`consumers or competition. Defendant could implement safeguards to remove data associated
`
`with sensitive locations from its data feeds. Such safeguards could be implemented at a
`
`reasonable cost and expenditure of resources.
`
`
`
`9
`
`
`
`Case 2:22-cv-00377-DCN Document 1 Filed 08/29/22 Page 10 of 11
`
`*
`
`*
`
`*
`
`33.
`
`Based on the facts and violations of law alleged in this Complaint, the FTC has
`
`reason to believe that Defendant is violating or is about to violate laws enforced by the
`
`Commission.
`
`VIOLATIONS OF THE FTC ACT
`
`34.
`
`Section 5(a) of the FTC Act, 15 U.S.C. § 45(a), prohibits “unfair or deceptive acts
`
`or practices in or affecting commerce.”
`
`35.
`
`Acts or practices are unfair under Section 5 of the FTC Act if they cause or are
`
`likely to cause substantial injury to consumers that consumers cannot reasonably avoid
`
`themselves and that is not outweighed by countervailing benefits to consumers or competition.
`
`15 U.S.C. § 45(n).
`
`Count I
`
`Unfair Sale of Sensitive Data
`
`36.
`
`In numerous instances, Defendant has sold, licensed, or otherwise transferred
`
`precise geolocation data associated with unique persistent identifiers that reveal consumers’
`
`visits to sensitive locations, including, among others, locations associated with medical care,
`
`reproductive health, religious worship, mental health, temporary shelters, such as shelters for the
`
`homeless, domestic violence survivors, or other at-risk populations, and addiction recovery.
`
`37.
`
`Defendant’s actions cause or are likely to cause substantial injury to consumers
`
`that consumers cannot reasonably avoid themselves and that is not outweighed by countervailing
`
`benefits to consumers or competition.
`
`
`
`10
`
`
`
`Case 2:22-cv-00377-DCN Document 1 Filed 08/29/22 Page 11 of 11
`
`38.
`
`Therefore, Defendant’s acts or practices as set forth in Paragraph 35 constitute
`
`unfair acts or practices in violation of Section 5 of the FTC Act, 15 U.S.C. § 45(a), (n).
`
`CONSUMER INJURY
`
`39.
`
`Consumers are suffering, have suffered, and will continue to suffer substantial
`
`injury as a result of Defendant’s violations of the FTC Act. Absent injunctive relief by this
`
`Court, Defendant is likely to continue to injure consumers and harm the public interest.
`
`
`
`Wherefore, Plaintiff requests that the Court:
`
`PRAYER FOR RELIEF
`
`A.
`
`Enter a permanent injunction to prevent future violations of the FTC Act by
`
`Defendant; and
`
`B.
`
`Award any additional relief as the Court determines to be just and proper.
`
`
`
`
`
`
`
`
`
`
`Dated: August 29, 2022
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`Respectfully submitted,
`
` /s Brian Shull
`
`BRIAN SHULL
`JULIA A. HORWITZ
`Federal Trade Commission
`600 Pennsylvania Avenue, N.W.
`Washington, D.C. 20580
`(202) 326-3734 (Shull)
`(202) 326-2269 (Horwitz)
`bshull@ftc.gov
`jhorwitz@ftc.gov
`
`Attorneys for Plaintiff
`FEDERAL TRADE COMMISSION
`
`11
`
`