/>iYesterday, in the District of Idaho, the Federal Trade Commission (“FTC”) filed a rare complaint seeking a permanent injunction against Kochava Inc. (“Kochava”), a company that, according to the FTC, is a “location data broker that provides its customers massive amounts of precise geolocation data collected from consumers’ mobile devices.” Case No. 22-cv-00377 (D. Idaho). Kochava itself this month had earlier commenced litigation against the FTC in a dramatic pushback after receiving a proposed injunction from the agency. This case is a must-watch going forward, given the FTC’s recent focus on data privacy and cybersecurity.
The Complaint filed yesterday in federal court alleges that “Kochava has sold access to its data feeds on online data marketplaces that are publicly accessible.” Additionally, while “Kochava typically charges a monthly subscription fee of thousands of dollars to access its location data feed,” the FTC also alleges that the company “has also offered a free sample . . . [which is] publicly available with only minimal steps and no restrictions on usage.”
In its Complaint, the FTC contends that “the data sold by Kochava may be used to identify individual consumers and their visits to sensitive locations. The sale of such data poses an unwarranted intrusion into the most private areas of consumers’ lives and causes or is likely to cause substantial injury to consumers.” This includes, according to the FTC, the risk that “the data may be used to identify consumers who have visited an abortion clinic and, as a result, may have had or contemplated having an abortion,” as well as in other contexts that could cause consumer harm. This includes under circumstances “associated with medical care, reproductive health, religious worship, mental health, temporary shelters, such as shelters for the homeless, domestic violence survivors, or other at-risk populations, and addiction recovery.”
The FTC’s July announcement came in the wake of an Executive Order from President Biden intended to address, among other issues, the potential threat to patient privacy caused by the transfer and sale of sensitive health-related data and by digital surveillance related to reproductive healthcare services.
The FTC’s Complaint against Kochava is premised upon Section 13(b) of the FTC Act, 15 U.S.C. Section 53(b), which authorizes the FTC to seek preliminary and permanent injunctions to remedy “any provision of law enforced by the [FTC].” In instances where the FTC has “reason to believe” that any party “is violating, or is about to violate” a provision of law enforced by the FTC, the FTC may request a federal district court to enjoin the purportedly unlawful conduct, pending further proceeding to determine whether the conduct at issue is in fact unlawful. 15 U.S.C. Section 53(b). Additionally, “in proper cases,” the FTC may seek permanent injunctive relief. Id.
By way of reference, the first Section 13(b) permanent injunction was sought by the FTC in 1979 concerning allegations that two mobile home manufacturers had issued written warranties to mobile home purchasers that, on their face, misrepresented the purchasers’ warranties. In recent years, Section 13(b) has been utilized most frequently—as the FTC’s own website admits—in the merger context.
However, the FTC is now pursuing a broader application of Section 13(b) to enforce Section 5(a) of the FTC Act, which generally prohibits unfair or deceptive acts or practices in or affecting commerce. 15 U.S.C. Section 45(a). For instance, in 2021, the Supreme Court ruled in AMG Capital Management, LLC v. Federal Trade Commission that courts could not award refunds to consumers in FTC cases brought under Section 13(b) of the FTC Act (which had been relied upon by the FTC for decades to collect billions of dollars from wrongdoers). The case was commenced by the FTC filing suit to seek a permanent injunction under Section 13(b) against a payday lender for purported violations of Section 5(a) of the FTC Act.
On August 10, Kochava “announced a capability for its Kochava Collective marketplace . . . [t]he new capability is a ‘Privacy Block’ which removes health services location data from the Kochava Collective marketplace.” This may have been designed to set up a challenge to the subsequent action filed by the FTC yesterday. Some courts, including, for instance, the Third Circuit Court of Appeals, have viewed the FTC’s authority under Section 13(b) with skepticism.
In a 2019 decision, the Third Circuit unambiguously held that “Section 13(b) requires that the FTC have reason to believe a wrongdoer ‘is violating’ or ‘is about to violate’ the law . . . Simply put, Section 13(b) does not permit the FTC to bring a claim based on long-past conduct without some evidence that the defendant ‘is’ committing or ‘is about to’ commit another violation.”
Some courts within the Ninth Circuit (which is where the District of Idaho is located) have dismissed this ruling as inapposite to the Ninth Circuit precedent. However, the Ninth Circuit, in a June 2021 case, instead distinguished the Third Circuit litigation as arising under factually dissimilar circumstances rather than rejecting its holding outright.
For more on this, stay tuned. CPW will be there to keep you in the loop.
