“Esto perpetua” – let it be perpetual, in Latin – is the state motto of Idaho, but it doesn’t apply to the Federal Trade Commission’s lawsuit against Kochava.
A federal judge in Idaho rejected the FTC’s suit on Thursday in a 35-page filing that grants Kochava’s February motion to dismiss and gives the FTC an opportunity to refile its case within 30 days.
You can read the full decision here.
The FTC sued Kochava in August over allegedly unfair and deceptive business practices for selling visitation data tied to sensitive locations, such as abortion clinics, places of worship and mental health facilities.
According to Idaho District Judge B. Lynn Winmill, who presided over Kochava’s motion to dismiss, although the privacy concerns raised by the FTC in its complaint “are certainly legitimate,” they fail to adequately prove a likelihood of substantial consumer injury.
As Judge Winmill points out in his ruling, the FTC Act only prohibits acts and practices that cause “substantial injury” to consumers.
Theory vs. reality
As a quick refresher on the FTC’s original complaint, the crux of its argument is that by aggregating and selling historical geolocation data associated with mobile ad IDs, Kochava makes it possible for businesses to track a person’s movements to and from sensitive locations and make inferences about their behavior.
The data could be used, for example, to identify people who visited an abortion clinic or traveled out of state to receive reproductive health care, which, in some states, could result in arrest or prosecution.
Idaho, for example, where Kochava is based, is one of the strictest anti-abortion states in the country and criminalizes even assisting someone with an out-of-state abortion.
But Judge Winmill wrote that, although he did find the FTC’s theory of consumer injury to be “plausible” – that selling sensitive location information to ill-intentioned parties could put people at risk of suffering secondary harms – the FTC doesn’t point to any specific examples of harm.
“It only alleges that secondary harms are theoretically possible,” Winmill wrote, and doesn’t attach “any degree of probability to those risks.”
In other words, the FTC Act, which is what gives the commission its regulatory authority, requires that a defendant’s actions or practices actually cause or are likely to cause injury.
The “mere possibility” of injury, Winmill wrote, isn’t enough.
The privacy question
Winmill also poked holes in the second thesis of the FTC’s suit, which is the question of invasion of privacy.
Although, yes, an invasion of privacy alone can constitute “substantial injury” to consumers under the FTC Act, he writes, the court found that, in this case, the alleged privacy violation isn’t “sufficiently severe” enough to meet that legal threshold for three reasons.
One, Kochava isn’t being accused of disclosing private information, but rather of selling data from which private information might be inferred – and “inferences are often unreliable.”
Winmill writes that geolocation data used to observe a device in the vicinity of an oncology clinic twice in one week could be because the device owner suffers from cancer … or because a member of their family does … or because they work for a medical equipment company.
Two, the information Kochava collects is also accessible through other lawful means, like observing someone walking into an oncology clinic and then finding out where they live by looking at publicly available property records. (True, Winmill, but rather creepy, no?)
And, three, the FTC’s suit must indicate, even generally, how many people may suffer privacy intrusions as a result of Kochava’s data sales. Whether the privacy violation counts as a substantial consumer injury depends, at least in part, on the number of people who are being injured.
In a statement on Thursday, Kochava CEO Charles Manning said he’s “encouraged” that the court was receptive to Kochava’s arguments and “hopeful that challenging the FTC will bring necessary regulatory clarity that will ultimately benefit consumers and advertisers as a whole.”
Small victories
But despite dismissing the FTC’s case, Winmill did agree with the commission’s argument that consumers don’t have the power to reasonably avoid potential harms as a result of Kochava’s business practices, and that any benefits of tracking aren’t outweighed by the harms.
One of the FTC’s claims was that Kochava’s collection and use of location data is “opaque to consumers,” who typically don’t know the name of the company tracking them, how their data is used or who it’s shared with.
Winmill also wasn’t impressed with Privacy Block, a feature Kochava released in August right before the FTC filed its suit. Kochava claims the tool excludes any health-services-related location data from being sold in its data marketplace, but details are thin.
“Kochava offers almost no information about its new Privacy Block feature,” Winmill wrote, “nor is it clear why implementation of this feature – a readily reversible step – makes it unlikely that Kochava will resume its former practices in the future.”
Although the FTC hasn’t yet issued a statement about what it plans to do now that its case against Kochava has been dismissed, there’s no reason why it won’t refile its lawsuit within the 30-day window.
