‘More Than Enough’ in Suit vs. Kochava to Survive Dismissal Motion: FTC

There’s “no way to determine whether a particular individual is at a particular place” using the device identifier and geolocation data that Kochava sells to third parties, the company's lead attorney, Craig Mariam of Gordon & Rees, told a U.S. District Court for Idaho hearing Tuesday on Kochava’s motion to dismiss the FTC’s privacy complaint for failure to state a claim (see 2212050061).

The agency seeks a permanent injunction enjoining Kochava from acquiring consumers’ geolocation data and selling it in a format that allows entities to track their movements to sensitive locations.

The most a bad actor could determine via the data Kochava provides, “is that there is some sort of device that may have entered a location at some point in time,” said Mariam. That would require “significant effort, using third-party information that does not come from Kochava,” and analyzing the data in “excruciating detail,” he said.

It doesn’t mean “there’s an individual that can be tracked,” said Mariam. “It doesn’t mean there’s a consumer.” It could possibly be, “but that’s not the law,” he said. “That’s speculative, and because this is so speculative, this is not a plausible claim” on the FTC’s part, he said.

Kochava marks as “sensitive” the device and geolocation data it sells to third parties, but “it did nothing” to protect consumers’ privacy, countered lead FTC attorney Brian Shull. The company “discloses private, sensitive information about consumers to unknown and unauthorized third parties,” he said. The harm is “the disclosure of that information because it violates consumers’ privacy rights,” he said.

Contrary to Mariam’s assertions, the injury Kochava is causing consumers is “not speculative, it’s not attenuated, it’s happening right now,” said Shull. “Putting aside all the fog and red herrings raised by Kochava, the FTC’s complaint pleads each element of an unfairness claim based on specific facts and reasonable inferences,” he said. “It is a well-placed complaint that contains more than enough to survive a motion to dismiss at this stage of the litigation.”

The FTC’s complaint is based on “substantial injuries to consumers that are caused directly by Kochava’s practices,” said Shull. “The complaint alleges that Kochava compiles a staggering amount of this precise geolocation data for sale in a way that makes it easy for Kochava’s customers to track consumers to sensitive locations,” he said. “We know that because we got access to a sliver of Kochava’s data, and the FTC was able to track consumers to those sensitive locations.”

When U.S. District Judge Lynn Winmill reminded Shull that the FTC needs to show that Kochava is directly causing significant injury to consumers or is likely to do so, not just that such injury is possible, he responded: “We do know it’s happening.” The FTC believes there’s “a reasonable inference” that can be made at this stage of the litigation that the company’s practices are causing consumers significant harm, he said. “After discovery, we would be able to show more directly” what its customers do with the data Kochava sells them, he said.