On August 29, the Federal Trade Commission (FTC) announced that it has filed a lawsuit against the data broker Kochava Inc. for allegedly selling user location data "from hundreds of millions of mobile devices" that could show movement to and from sensitive locations, including domestic violence shelters, places of worship, and addiction and reproductive health clinics.

"Where consumers seek out health care, receive counseling, or celebrate their faith is private information that shouldn't be sold to the highest bidder," the Director of the FTC's Bureau of Consumer Protection, Samuel Levine, is quoted in the agency announcement. The FTC is taking Kochava to court to protect people's privacy and halt the sale of their sensitive geolocation information."

The FTC suit seeks to end Kochava's sale of sensitive location data, and the agency is also asking the court to require Kochava to delete any sensitive location data that it's gathered thus far.

According to the FTC, Kochava gathers and sells "vast troves of location data" that has been organized to help the broker's clients target users for advertisements and analyze the foot traffic in their stores. This data can be used to identify specific cellphone users and households based on their movements.

"Kochava's sale of geolocation data puts consumers at significant risk," the FTC announcement reads. "The FTC alleges that Kochava fails to adequately protect its data from public exposure. Until at least June 2022, Kochava allowed anyone with little effort to obtain a large sample of sensitive data and use it without restriction."

The FTC obtained a sample free sample made publicly available by Kochava showing the sorts of data the broker sells. That data allegedly includes "precise, timestamped location data collected from more than 61 million" devices and reveals movements relating to religious practices, productive health, domestic violence assistance, homelessness support, and addiction services, amongst the users' other everyday activities.

The FTC also claims in its announcement that many users are unaware of the fact that Kochava is collecting and selling their sensitive geolocation data.

For its part, Kochava recently announced that it's working on a way to block location data relating to sensitive locations. In a pre-emptive suit filed against the FTC in early Aug., Kochava claimed that its data cannot be used to identify specific users for the purpose of tracking movements. The data broker also claims it follows all laws and rules on user privacy, arguing that the FTC just doesn't understand its system.

"The FTC has a fundamental misunderstanding of Kochava's data marketplace business and other data businesses," Kochava general manager Brian Cox said. "Kochava operates consistently and proactively in compliance with all rules and laws."

The collection and sale of reproductive health data became a major concern this year after the overturning of Roe v Wade by the Supreme Court. Many are concerned that private data could be used to identify and punish individuals for seeking reproductive healthcare, something that has already been seen in at least one case of an alleged illegal abortion.