Sunday, September 25, 2022
More

    Latest Posts

    As the FTC begins its lawsuit against Kochava, some see the ‘warning sign’ to ad-tech while others see an uphill battle

    As the Federal Trade Commission begins its legal battle against one of the smaller startups in the ad-tech ocean, some legal and privacy experts are wondering if the agency is taking a new approach to frying fish.

    In a new lawsuit against the digital marketing data broker Kochava, the FTC alleges the Idaho-based company sold sensitive consumer geolocation data to companies collected from hundreds of millions of devices. According to the federal agency’s complaint, data collected around sensitive locations — places including reproductive health clinics, places of worship, homeless and domestic violence shelters and addiction recovery centers — could put people at risk of “stigma, discrimination, physical violence, emotional distress, and other harms.”

    Since its filing on Monday in federal court in Idaho, the lawsuit has left ad-tech insiders wondering why Kochava was singled out when it’s just one of many data brokers that track location data. Some speculate the regulatory agency wants to make an example out of Kochava without getting overly burdened by suing much larger companies in the ad-tech space. Experts see the lawsuit against a smaller player like Kochava as a warning sign to the broader data broker industry while others say the FTC’s case will be legally challenging and face a high bar. Regardless of the outcome, the legal battle also raises new questions about the future of location-based data — and the appetite advertisers have for it.

    Although the FTC has investigated various aspects of the online ad industry — it issued a 2014 report calling on more transparency and accountability for data brokers — the agency has traditionally focused more on giants like internet and telecom companies. The most famous example of FTC enforcement related to data privacy was its landmark settlement with Facebook 2019 following an investigation into how the British firm Cambridge Analytica collected user data. (The FTC declined Digiday’s interview request about its Kochava lawsuit.)

    “That’s the most significant part of this: We’re moving down the supply chain,” said Zach Edwards, an independent researcher. “It’s no longer just the Cambridge Analyticas. We’re going a foot deep instead of an inch deep.”

    The new complaint comes a week before the FTC will hold its first public hearing as part of the information-gathering process to inform potential new rules regulating “commercial surveillance.” It also comes as Congress considers new federal regulations under the proposed American Data Privacy And Protection Act, which would give the FTC expanded regulatatory powers.

    “One thing is size, but it’s also their role,” said Jessica Lee, chair of the law firm Loeb & Loeb’s privacy, security and data innovations practice when asked about why the FTC would target Kochava. “If you really want to try to effect change — particularly in this case where the issue is the data feeds that are made available — it might make more sense to come after a company that’s in the supply chain, and that’s really where Kochava is.”

    Former FTC officials told Digiday that the agency is taking a different approach from how it’s sought to regulate data privacy with giants such as internet and telecom companies. Instead of trying to prove Kochava has been deceptive — a key tenet in the 2019 case involving Facebook and Cambridge Analytica — the allegations focus on “unfair” practices with user data. Some lawyers say gives the case more legal standing but others note the FTC needs to prove how Kochava’s practices could harm consumers.

    Other times the FTC sued companies over privacy include 2021 settlements with the period-tracking app Flo and the ad platform OpenX. Despite the FTC’s recent track record of privacy-related settlements, Kochava has chosen to preemptively fight back. Earlier this month, it filed a countersuit against the FTC claiming the agency has wrongly threatened the company and mischaracterized its business.

    Ruben Schreurs, chief product officer at the media management firm Ebiquity, said the FTC is in some ways creating a “no-fly zone” around the use of sensitive data. Even if Kochava isn’t the largest player, he thinks a legal win would potentially give the agency “some meat” to showcase before it begins to revamp its data privacy rules in the coming months.

    The lawsuit also sheds more light on the location-tracking industry and could help “blow open” a broader discussion about what companies should be allowed to track, according to Joseph Turow, a longtime privacy researcher and professor of media systems and industries at the University of Pennsylvania. However, he said it doesn’t fully address what the agency wants companies to change or how the government should regulate data beyond sensitive topics.

    “It really is a question of whether this is an acceptable aspect of society,” Turow said. “And I think the FTC has to confront that.”

    Kochava—which buys precise geolocation data from various third-party vendors—uses the data in two main ways. Along with helping brands measure ad performance based on footfall traffic, it also sells data to other ad-tech companies that then provide targeted data based on location. Even if there are not yet new laws to regulate location-tracking, legal experts say a settlement could have potential repercussions and that similar violations in the future could open the door for further FTC enforcement. Although Kochava says it vets data brokers it works with, the agency’s lawsuit claims the data isn’t anonymized and could put consumers at risk of being identified by their devices and other personal information.

    In a written statement emailed to Digiday on Monday evening, Brian Cox, general manager of Kochava Collective said this week’s lawsuit “shows the unfortunate reality that the FTC has a fundamental misunderstanding of Kochava’s data marketplace business and other data businesses.” Cox said the agency’s desired settlement “had no clear terms or resolutions and redefined the problem into a moving target,” adding that the company recently rolled out new ways to block geo data from sensitive locations.

    “Real progress to improve data privacy for consumers will not be reached through flamboyant press releases and frivolous litigation,” Cox in his statement. “It’s disappointing that the agency continues to circumvent the lawmaking process and perpetuate misinformation surrounding data privacy.”

    An uphill battle:

    Some former FTC officials who spoke with Digiday have doubts about whether the case could win in court. Megan Gray, a former FTC attorney focused on enforcing privacy who is now CEO of GrayMatters Law and Policy said she thinks the agency will lose the case based on its merits.

    “How this case is understood — which is the agency suing a data broker for selling geo-location data without a sensitive locations filter and without delineating permissible purposes for its customers — that’s new,” she said. “That is on the bleeding edge forefront for privacy perspectives, and a company can genuinely say ‘we didn’t know.’”

    Even if she thinks the FTC’s own case has weaknesses, Gray said it “rarely makes sense” to file suit against the FTC, especially since the financial penalties are often small and the terms aren’t “particularly onerous.”

    Regardless of what happens with Kochava, others suggest companies that sell or share precise geolocation data could also potentially face similar actions. Allison Lefrak, svp of public policy and ads privacy at Pixalate, noted a part of the FTC’s complaint that suggest Kochava should have created a blacklist for the regions it outlines in the lawsuit.

    Lefrak — who spent nearly a decade at the FTC including as an attorney focused on privacy and identity protection — said recent actions suggest the agency is indicating an increased interest in going after the “commercial surveillance” industry.

    “If I were an ad-tech data broker, I’d get on this blacklist recommendation,” Lefrak said.

    The post As the FTC begins its lawsuit against Kochava, some see the ‘warning sign’ to ad-tech while others see an uphill battle appeared first on Digiday.

    Latest Posts

    Don't Miss

    Stay in touch

    To be updated with all the latest news, offers and special announcements.