On August 29, 2022, the Federal Commerce Fee (FTC) filed a lawsuit in opposition to Kochava, Inc. alleging that Kochava engaged in unfair and misleading practices by promoting the “exact location data” of customers. This swimsuit comes on the heels of the FTC’s announcement earlier this month that it might “crack down” on “business surveillance practices” and July’s warning that the company can be exercising its enforcement authority in opposition to the “unlawful” use and sharing of delicate client information.
The FTC alleges that Kochava amassed a considerable amount of delicate information by monitoring the cellular promoting IDs from lots of of tens of millions of cell phones, and that such information could possibly be used to trace folks visiting abortion clinics, home abuse shelters, locations of worship and different delicate areas. The FTC then stated that Kochava bought that information with out first anonymizing it, permitting anybody who bought the information to make use of it to trace the actions of the cellular system customers. The FTC desires to not solely block Kochava from promoting such information, but additionally require them to delete and destroy it. In its criticism, the FTC relied on the FTC Act’s common prohibition in opposition to “unfair and misleading acts or practices” and alleged that the corporate unfairly bought the delicate information.
Kochava, which beat the FTC to the courthouse and preemptively filed a lawsuit in opposition to the FTC previous to the FTC’s criticism, asserted that all the location information got here from third-party information brokers who obtained the knowledge from consenting customers. Regardless of the alleged consent, Kochava says it’s within the technique of implementing steps to take away well being providers location information from its database. Kochava argued that the litigation was the end result of the FTC’s failed try to implement a imprecise settlement that had no clear phrases and made the issue a transferring goal.
The Kochava swimsuit brings to the forefront a number of competing coverage concerns, the willpower of which may form the scope of the FTC’s enforcement authority for years to return. The in the beginning challenge that the Kochava swimsuit raises is whether or not the FTC has the authority to successfully impose a consent-based regime for the sale of delicate client data when no federal legislation enforced by the FTC (aside from the Youngsters’s On-line Privateness Defend Act (COPPA), which applies to information collected about kids underneath 13) expressly supplies for that requirement. Whereas it isn’t unusual for the FTC to take expansive views of its enforcement authority, that authority has been efficiently challenged lately. (See AMG Capital Management, LLC v. FTC, which held that the FTC doesn’t have the statutory authority to hunt equitable financial reduction underneath Part 13(b) of the FTC Act).) Now, Kochava will take a look at the FTC’s authority to control within the privateness area—and the FTC might not just like the outcome.
Within the unlikely occasion that Kochava had been to litigate in opposition to the FTC all the way in which to the Supreme Court docket of america, Kochava would possibly discover a receptive viewers. Utilizing West Virginia v. Environmental Protection Agency as precedent, the Supreme Court docket may conclude that US Congress didn’t grant the FTC authority to control privateness points as a result of the FTC Act doesn’t expressly point out privateness regulation as being throughout the ambit of the FTC’s authority. This could be a giant drawback for the FTC, which has visions of participating in formal rulemaking on privateness and information safety.
Weighing in favor of the FTC’s criticism is the truth that the FTC seems to be cracking down on the exact kinds of privateness considerations that the general public has been centered on within the wake of Dobbs v. Jackson Women’s Health Organization. Since Dobbs, we’ve seen firms and personal residents undergo nice lengths to guard the necessity for elevated sensitivity and privateness for the knowledge relating to an individual’s go to to an abortion clinic. The FTC argues that that is precisely that kind of delicate geographic data that it seeks to guard, little doubt appearing on US President Joe Biden’s government order following Dobbs, which instructed the FTC to take motion to guard client privateness relating to reproductive well being. Whereas the president’s government order might give these marching orders to the FTC, it doesn’t increase the FTC’s authorized authority nor give them new powers.
Because of this, the Kochava motion, which is according to the FTC’s view of its personal enforcement authority within the privateness area, pits a problem of nice public concern in opposition to the exhausting and quick statutory limits of the FTC’s authority as granted by Congress. Whereas the likeliest final result is a settlement that doesn’t adjudicate that the FTC has the authority to control problems with privateness, Kochava is nonetheless price watching. Kochava may both cement the FTC’s authority to control within the privateness area or severely restrict the FTC’s authority to take action, which could really be the precise catalyst that Congress must lastly go a federal privateness invoice.
If you’re at the moment going through an FTC investigation, please attain out to your common McDermott lawyer or contact Lesli Esposito, Amy Pimentel or David Saunders with any questions.