The FTC took Kochava, a data broker, to federal court – and more court cases like these are undoubtable in the next year

Data Broker Industry Following publication of an advanced notice of public rulemaking (“ANPR”) in August 2022 highlighting the FTC’s concerns about the , it came as no surprise when later that same month, the agency took action against data broker Kochava. The FTC argued that Kochava’s collection and sale of consumers’ precise geolocation from their mobile devices, enabling tracking of their movements to sensitive locations such as reproductive health clinics, places of worship, homeless and domestic violence shelters, and addiction recovery centers, exposes consumers to injury in the form of stigma, discrimination, physical violence, emotional distress, and other harms. The FTC sought a permanent injunction in Iowa federal court on the grounds that Kochava’s sale of sensitive data constituted an “unfair” practice in violation of Section 5 of the FTC Act in that it causes or is likely to cause substantial injury to consumers that they cannot reasonably avoid and that is not outweighed by countervailing benefits to consumers or competition. However, in May 2023, the judge granted Kochava’s motion to dismiss, finding that the FTC did not sufficiently allege substantial consumer harm, but allowing the agency to file an amended complaint. The FTC did so the next month, offering additional factual allegations in an amended complaint that was only just unsealed in November 2023 despite the opposition of Kochava, whose motion for Rule 11 sanctions against the FTC was denied. We expect 2024 to bring further intrigue in this ongoing saga. The data broker industry will undoubtedly continue to be under the spotlight in the new year and years to come. In addition to potential next steps by the FTC in connection with the ANPR discussed above, the Consumer Financial Protection Bureau this year announced an into data brokers’ business practices and specifically whether certain data brokers should be under the Fair Credit Reporting Act. States have also been active in this space, with Texas and Oregon passing data broker statutes in 2023, and California amending its existing data broker law. The California is particularly noteworthy for its novel requirement that by 2026 all data brokers respond to a single deletion mechanism, to be created by the California Privacy Protection Agency, through which consumers can direct data brokers to delete their personal information. Given the broad manner in which a data broker is defined under these state laws, companies should evaluate whether their practices may bring them within scope.