FTC lawsuit against Kochava is data practices warning for ad industry

The ad tech company Kochava is being sued by U.S. regulators, serving as a warning to the rest of the advertising industry as it faces more zealous oversight of “commercial surveillance.” The Federal Trade Commission named Kochava in a lawsuit today, alleging the company sold location data that could expose whether an individual went to an abortion clinic and other sensitive personal information. The FTC claimed that Kochava, which is a mobile advertising measurement and analytics firm, “collects a wealth of information about consumers and their mobile devices by, among other means, purchasing data from other data brokers to sell to its own customers.” “Kochava then sells customized data feeds to its clients to, among other purposes, assist in advertising and analyzing foot traffic at stores or other locations,” the FTC claimed in its lawsuit. “This lawsuit shows the unfortunate reality that the FTC has a fundamental misunderstanding of Kochava’s data marketplace business and other data businesses,” Brian Cox, the general manager of Kochava Collective, a real-time data practice within Kochava, said in a statement. “Kochava operates consistently and proactively in compliance with all rules and laws, including those specific to privacy.” Sign up for Ad Age newsletters From influencer marketing to agencies, get the latest news and analysis delivered to your inbox Click here The FTC has become more aggressive in its enforcement stance, putting the entire ad industry on notice that it would be looking into how consumer data is collected and shared. Earlier this month, the FTC sent a request for feedback about how it should police “commercial surveillance and lax data security practices.” While the FTC looks at federal enforcement, states like California are carrying out their own enforcement of privacy and data laws. Also, U.S. lawmakers are working on nationwide laws, including the American Data Privacy and Protection Act. With the Kochava lawsuit, the FTC is making a case that criticizes practices that might seem fairly standard to the advertising industry. The FTC outlined how Kochava made data available for sale through subscriptions on Amazon Web Services' marketplace. Kochava’s location data sets could potentially be paired with unique device information that reveals a person’s whereabouts, the FTC claimed. The data sold by Kochava “may be used to track consumers to sensitive locations, including places of religious worship, places that may be used to infer an LGBTQ+ identification, domestic abuse shelters, medical facilities, and welfare and homeless shelters,” the FTC said in its lawsuit. Regulators and many U.S. lawmakers are concerned about how location data could be used to expose whether a person visited an abortion clinic, for instance, which has become even more sensitive data since some states are prosecuting people for seeking abortion services. In June, the abortion issue became more urgent after the Supreme Court reversed precedent on abortion protections. The FTC’s case against Kochava was a “shot across the bow,” said a major ad agency executive, who spoke on condition of anonymity. Regulators have been ramping up pressure with regards to the “whole privacy conversation, which became very real with the overturning of Roe V. Wade,” the agency exec said. Privacy block Kochava had anticipated it could face some scrutiny. Earlier this month, Kochava announced it would offer a “privacy block” that “removes health services location data from the Kochava Collective marketplace.” Kochava Collective is one of Kochava’s real-time data products, which buys location data from third parties. Jessica B. Lee, the privacy, security and data innovations lead at law firm Loeb and Loeb, wrote about the lawsuit in a Twitter thread on Monday. The case against Kochava “reads like an indictment of the business model more than indictment about the specific practices of one business,” she tweeted. “It will be interesting to see how this plays out, but it’s yet another sign of the FTC’s determination to push ahead on its enforcement priorities.” It's not just ad tech companies and data brokers that have come under scrutiny. Just last week, Sephora settled a case with California, which accused the beauty retailer of inappropriately collecting data on consumers. Sephora settled for $1.2 million without admitting to specific breaches of the California Consumer Privacy Act. Meanwhile, on Monday, the FTC also set its agenda for a public forum next month on “the harms stemming from commercial surveillance and lax data security practices and whether new rules are needed to protect people’s privacy and information.” The ad industry is somewhat torn on how to continue with practices that in the past seemed commonplace but now could draw fire from a public that is more concerned with privacy. The industry has typically relied on easy access to data to personalize sales pitches, target ads, provide services and conduct research on the consuming public. Earlier this month, the IAB released a statement that was critical of the FTC’s inquiry into “commercial surveillance.” “What some are calling ‘commercial surveillance’ is the necessary exchange of information at the heart of the free and open internet, generating opportunities for creativity, community and commerce,” the IAB wrote. “Safely and securely, millions of Americans, including in the digital advertising industry, earn their livings with the responsible use of data.”

FTC lawsuit against ad tech firm is a warning over data practices for the entire ad industry

Featured Stories