Because the Federal Commerce Fee begins its authorized battle in opposition to one of many smaller startups within the ad-tech ocean, some authorized and privateness consultants are questioning if the company is taking a brand new strategy to frying fish.
In a brand new lawsuit in opposition to the digital advertising and marketing knowledge dealer Kochava, the FTC alleges the Idaho-based firm sold sensitive consumer geolocation data to companies collected from tons of of thousands and thousands of gadgets. In keeping with the federal company’s complaint, knowledge collected round delicate areas — locations together with reproductive well being clinics, locations of worship, homeless and home violence shelters and habit restoration facilities — may put individuals susceptible to “stigma, discrimination, bodily violence, emotional misery, and different harms.”
Since its submitting on Monday in federal court docket in Idaho, the lawsuit has left ad-tech insiders questioning why Kochava was singled out when it’s simply certainly one of many knowledge brokers that monitor location knowledge. Some speculate the regulatory company needs to make an instance out of Kochava with out getting overly burdened by suing a lot bigger firms within the ad-tech area. Consultants see the lawsuit in opposition to a smaller participant like Kochava as a warning signal to the broader knowledge dealer trade whereas others say the FTC’s case will probably be legally difficult and face a excessive bar. Whatever the consequence, the authorized battle additionally raises new questions on the way forward for location-based knowledge — and the urge for food advertisers have for it.
Though the FTC has investigated varied points of the web advert trade — it issued a 2014 report calling on extra transparency and accountability for knowledge brokers — the company has historically centered extra on giants like web and telecom firms. Probably the most well-known instance of FTC enforcement associated to knowledge privateness was its landmark settlement with Fb 2019 following an investigation into how the British agency Cambridge Analytica collected person knowledge. (The FTC declined Digiday’s interview request about its Kochava lawsuit.)
“That’s essentially the most important a part of this: We’re shifting down the availability chain,” mentioned Zach Edwards, an unbiased researcher. “It’s now not simply the Cambridge Analyticas. We’re going a foot deep as a substitute of an inch deep.”
The brand new criticism comes per week earlier than the FTC will maintain its first public listening to as a part of the information-gathering course of to tell potential new guidelines regulating “industrial surveillance.” It additionally comes as Congress considers new federal laws beneath the proposed American Knowledge Privateness And Safety Act, which might give the FTC expanded regulatory powers.
“One factor is measurement, but it surely’s additionally their position,” mentioned Jessica Lee, chair of the legislation agency Loeb & Loeb’s privateness, safety and knowledge improvements follow when requested about why the FTC would goal Kochava. “If you happen to actually need to attempt to impact change — significantly on this case the place the difficulty is the info feeds which might be made accessible — it would make extra sense to return after an organization that’s within the provide chain, and that’s actually the place Kochava is.”
A unique form of case and a uncommon countersuit
Former FTC officers informed Digiday that the company is taking a unique strategy from the way it’s sought to manage knowledge privateness with giants comparable to web and telecom firms. As an alternative of attempting to show Kochava has been misleading — a key tenet within the 2019 case involving Fb and Cambridge Analytica — the allegations deal with “unfair” practices with person knowledge. Some attorneys say offers the case extra authorized standing however others be aware the FTC must show how Kochava’s practices may hurt customers.
Different occasions the FTC sued firms over privateness embody 2021 settlements with the period-tracking app Flo and the advert platform OpenX. Regardless of the FTC’s latest monitor report of privacy-related settlements, Kochava has chosen to preemptively struggle again. Earlier this month, it filed a countersuit in opposition to the FTC claiming the company has wrongly threatened the corporate and mischaracterized its enterprise.
In a written assertion, Kochava Collective Common Supervisor Brian Cox mentioned the FTC’s lawsuit “exhibits the unlucky actuality that the FTC has a elementary misunderstanding of Kochava’s knowledge market enterprise and different knowledge companies.” He mentioned Kochava not too long ago rolled out new methods to dam geolocation knowledge from delicate areas, including that the company’s desired settlement “had no clear phrases or resolutions and redefined the issue right into a shifting goal.”
Kochava—which buys exact geolocation knowledge from varied third-party distributors—makes use of the info in two essential methods. Together with serving to manufacturers measure advert efficiency primarily based on footfall visitors, it additionally sells knowledge to different ad-tech firms that then present focused knowledge primarily based on location. The corporate says it vets knowledge brokers it really works with, however the FTC claims the info isn’t anonymized and will put customers susceptible to being recognized by their gadgets and different private data. Even when there usually are not but new legal guidelines to manage location-tracking, authorized consultants say a settlement may have potential repercussions and that related violations sooner or later may open the door for additional FTC enforcement.
“Actual progress to enhance knowledge privateness for customers is not going to be reached by flamboyant press releases and frivolous litigation,” in keeping with Cox’s assertion emailed to Digiday. “It’s disappointing that the company continues to bypass the lawmaking course of and perpetuate misinformation surrounding knowledge privateness.”
Ruben Schreurs, chief product officer on the media administration agency Ebiquity, mentioned the FTC is in some methods making a “no-fly zone” round using delicate knowledge. Kochava isn’t the biggest participant, however he thinks a authorized win would probably give the company “some meat” to showcase earlier than it begins to revamp its knowledge privateness guidelines within the coming months.
The lawsuit additionally sheds extra mild on the location-tracking trade and will assist “blow open” a broader dialogue about what firms ought to be allowed to trace, in keeping with Joseph Turow, a longtime privateness researcher and professor of media programs and industries on the College of Pennsylvania. Nonetheless, he mentioned it doesn’t absolutely handle what the company needs firms to vary or how the federal government ought to regulate knowledge past delicate subjects.
“It truly is a query of whether or not that is an appropriate facet of society,” Turow mentioned. “And I feel the FTC has to confront that.”
The uphill battle
Some former FTC officers who spoke with Digiday have doubts about whether or not the case may win in court docket. Megan Grey, a former FTC lawyer centered on implementing privateness who’s now CEO of GrayMatters Regulation and Coverage, mentioned she thinks the company will lose the case primarily based on its deserves.
“How this case is known — which is the company suing an information dealer for promoting geo-location knowledge with no delicate areas filter and with out delineating permissible functions for its prospects — that’s new,” she mentioned. “That’s on the bleeding edge forefront for privateness views, and an organization can genuinely say ‘we didn’t know.’”
Though Grey thinks the FTC’s personal case has weaknesses, she mentioned it “not often is sensible” to file swimsuit in opposition to the FTC, particularly because the monetary penalties are sometimes small and the phrases aren’t “significantly onerous.”
No matter what occurs with Kochava, others recommend firms that promote or share exact geolocation knowledge may additionally probably face related actions. Issues round abortion-related knowledge because the U.S. Supreme Court docket overturned Roe v. Wade have additionally made knowledge privateness a heightened precedence throughout different elements of the Biden administration.
Allison Lefrak — who spent practically a decade as an lawyer on the FTC centered on privateness and identification safety — famous part of the FTC’s criticism that implies Kochava ought to have created a blacklist for areas associated to the varieties of knowledge addressed within the lawsuit. Now senior vp of public coverage and advertisements privateness at Pixalate, Lefrak mentioned latest actions recommend the company is indicating an elevated curiosity in going after the “industrial surveillance” trade.
“If I have been an ad-tech knowledge dealer, I’d get on this blacklist suggestion,” Lefrak mentioned.