Federal Trade Commission v. Kochava, Inc.

• Court: District Court, D. Idaho
• Decided: February 3, 2024
• Docket: 2:22-cv-00377
• Status: Unknown

Opinion

UNITED STATES DISTRICT COURT FOR THE DISTRICT OF IDAHO

FEDERAL TRADE COMMISSION, Case No. 2:22-cv-00377-BLW Plaintiff, MEMORANDUM DECISION AND v. ORDER

KOCHAVA, INC.,

Defendant.

INTRODUCTION Before the Court is Defendant Kochava, Inc.’s Motion to Dismiss First Amended Complaint Pursuant to Fed. R. Civ. P. 12(b)(6) (Dkts. 33 & 34). The motion is fully briefed, and the Court has determined that oral argument would not aid in the decisional process. For the reasons explained below, the Court will deny the motion. BACKGROUND1 1. This Lawsuit The Federal Trade Commission (FTC) claims that Kochava, Inc. is violating Section 5(a) of the Federal Trade Commission Act (the “FTC Act”) by aggregating

1 At this stage, the Court must assume the truth of the FTC’s factual allegations. and selling vast amounts of data collected from mobile devices. See Am. Compl., Dkt. 26. The FTC argues that Kochava’s data sales invade consumers’ privacy and

expose them to risks of secondary harms by third parties. Thus, according to the FTC, Kochava is engaging in an “unfair . . . act or practice” prohibited by Section 5(a) of the FTC Act, 15 U.S.C. § 45(a)(1). To prevent Kochava from continuing to

do so, the FTC seeks a permanent injunction under Section 13(b), 15 U.S.C. § 53(b). In its original Complaint (Dkt. 1), the FTC focused on one subset of Kochava’s data: geolocation coordinates. The FTC alleged that, by linking mobile

device location coordinates to Mobile Advertising IDs (MAIDs), Kochava enables its customers to identify specific device users who have visited certain sensitive locations. According to the FTC, Kochava’s geolocation data invades consumers’

personal privacy and creates a risk that third parties will target consumers based upon their visits to certain sensitive locations, such as abortion clinics. 2. Dismissal of the Original Complaint On October 28, 2022, Kochava moved to dismiss the FTC’s original

Complaint and the Court held oral argument on February 21, 2023. Dkt. 20. Ultimately, the Court dismissed the Complaint because it lacked adequate allegations that Kochava’s data sales “cause[] or [are] likely to cause” a

“substantial injury” to consumers, as required by Section 5(n) of the FTC Act. See Mem. Decision & Order at 24–25, Dkt. 24. Although the Court held that both of the FTC’s theories of consumer injury were legally plausible, it concluded that the

alleged injury did not rise to the requisite level of substantiality. Under the FTC’s first theory, Kochava’s data sales create a risk of secondary harm to consumers. That is, Kochava’s customers could use the geolocation data to

identify mobile device users who have visited sensitive locations and, based on inferences arising from that information, inflict secondary harms including stigma, discrimination, physical violence, and emotional distress. Compl. ¶ 29, Dkt. 1. The Court agreed that a company could substantially injure consumers within the

meaning of Section 5(n) by selling their sensitive location information and thereby subjecting them to a significant risk of suffering concrete harms at the hands of third parties. Mem. Decision & Order at 14, Dkt. 24. However, the Court found

insufficient allegations as to the significance of such risks in this case. The Court explained that to adequately plead this theory of consumer injury, the FTC must “go one step further and allege that Kochava’s practices create a ‘significant risk’ that third parties will identify and harm consumers.” Id. at 17.

Under the FTC’s second theory, Kochava’s geolocation data deprives consumers of their privacy. That is, the loss of privacy—rather than some secondary harm that could flow from the disclosure of the information—is itself an

injury to consumers. The Court also agreed that this theory is legally plausible but concluded that the privacy intrusion alleged in the Complaint was not severe enough to constitute a “substantial injury” under Section 5(n).

The Court dismissed the Complaint but gave the FTC an opportunity to file an amended complaint containing additional factual allegations. The FTC did so, filing its Amended Complaint (Dkt. 26) on June 26, 2024. Kochava promptly

moved to dismiss the Amended Complaint under Rule 12(b)(6), arguing that the FTC has not cured the deficiencies identified in the Court’s prior Memorandum Decision and Order, Dkt. 24. As explained below, the Court disagrees. LEGAL STANDARD

To survive a motion to dismiss, a complaint must contain sufficient factual matter, accepted as true, to “state a claim to relief that is plausible on its face.” Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 570 (2007). “[D]ismissal may be based

on either a lack of a cognizable legal theory or the absence of sufficient facts alleged under a cognizable legal theory.” Johnson v. Riverside Healthcare Sys., 534 F.3d 1116, 1121 (9th Cir. 2008) (cleaned up). However, Rule 12(b)(6) “does not impose a probability requirement at the pleading stage; it simply calls for

enough facts to raise a reasonable expectation that discovery will reveal evidence” of the truth of the allegations. Twombly, 550 U.S. at 556. Section 5(a) of the FTC Act prohibits “unfair” and “deceptive” acts or

practices that harm consumers or competitors. 15 U.S.C. § 45(a). And Section 13(b) of the same statute authorizes the FTC to seek injunctive relief if it “has reason to believe” that a business “is violating, or is about to violate, any provision

of law enforced by the [FTC],” including Section 5(a). 15 U.S.C. § 53(b). To demonstrate that an act or practice is “unfair” under Section 5(a), the FTC must prove that it “[1] causes or is likely to cause substantial injury to consumers which

is [2] not reasonably avoidable by consumers themselves and [3] not outweighed by countervailing benefits to consumers or to competition.” 15 U.S.C. 45(n); see also Mem. Decision & Order, Dkt. 24. DISCUSSION

According to the FTC, Kochava sells a substantial amount of data obtained from millions of mobile devices across the world. This includes precise geolocation data and a “staggering amount of sensitive and identifying

information,” including device users’ “names, MAIDs, addresses, phone numbers, email addresses, gender, age, ethnicity, yearly income, ‘economic stability,’ marital status, education level, political affiliation, ‘app affinity’ (i.e. what apps consumers have installed on their phones), app usage,” and “interests and

behaviors.” Am. Compl. ¶¶ 11, 16 & 20, Dkt. 26. By selling this data, the FTC claims, Kochava substantially harms consumers in violation of Section 5(a) of the FTC Act. See 15 U.S.C. § 45(a) & (n). The FTC’s claim is legally and factually plausible. In other words, Kochava’s practice of selling vast amounts of data about mobile device users may

violate Section 5(a) by depriving consumers of their privacy and exposing them to significant risks of secondary harms. The FTC’s Amended Complaint significantly expands the factual allegations in its original Complaint, and it easily satisfies the

liberal plausibility standard. 1. The FTC’s Allegations The Amended Complaint focuses on four of Kochava’s data products: geolocation data, the Database Graph, the App Graph, and audience segments. A

summary of each product may be helpful. Geolocation Data. Kochava’s geolocation data feeds contain timestamped latitude and longitude coordinates and associated MAIDs from “125 million

monthly active users, and 35 million daily active users, on average observing more than 90 daily transactions per device.” Am. Compl. ¶¶ 27 & 30, Dkt. 26. The coordinates can pinpoint a device’s location within less than 10 meters “for at least the past year” and reflect “movements as recent as the prior day.” Id. ¶ 26.

Database Graph. Kochava’s Database Graph contains “comprehensive profiles of individual consumers,” with up to “300 data points” for “over 300M unique individuals.” Id. ¶ 46. A given profile may contain a device user’s name,

address, phone number, MAID, ethnicity, gender identity, date of birth, status as a minor, status as a parent and number of children, political association, marital status, education, economic status, employment, languages spoken, device settings,

and social media presence. Id. ¶¶ 47–49, 53. App Graph. Kochava’s App Graph shows device users’ activities in particular mobile device applications. The graph contains usage information and

the associated MAIDs from over 275,000 mobile apps, including app names, the dates and lengths of app usage, the type of actions taken in the apps, and the amount of money spent in the apps. Am. Compl. ¶¶ 60 & 61, Dkt. 26. For example, the App Graph would show whether a device user has downloaded an

LGBTQ+ dating app, a Muslim prayer app, or an app for monitoring specific health concerns, like cancer or sexually transmitted infections. Id. ¶ 62. Audience Segments. Kochava also sells “audience segments,” which are

“subsets of its database of consumer information that identify consumers based on interests or characteristics.” Id. ¶ 64. For example, device users can be sorted by geography, demography, points of interest, web usage, political associations, parental status, or religious affiliations. Id. ¶¶ 64–76. Thus, one of Kochava’s

customers could generate a list of devices—with each device linked to a MAID— that are used by expecting parents, or pregnant people, or those with particular gender identities, or those associated with other specified interests or

characteristics. Id. ¶ 67–76. The FTC claims that Kochava’s customers “can and do purchase any and all of this data.”2 Am. Compl. ¶ 23, Dkt. 26. Consequently, although the data is

contained in separate collections, it “is not anonymized and is linked or easily linkable to individual consumers.” Id. ¶ 77. For example, drawing upon data contained in Kochava’s various collections, a customer could identify “a woman

who visits a particular building, the woman’s name, email address, and home address, and whether the woman is African-American, a parent (and if so, how many children), or has an app identifying symptoms of cancer on her phone.” Id. ¶ 23. And the customer could do this without “min[ing] other sources of data,”

because “[t]his ability is a featured product of Kochava.” Id. ¶¶ 80 & 81, Dkt. 26 (“For example, Kochava advertises that customers are able to search through its ‘500M+ MAIDs’ to identify, among other things, the consumer’s name, address,

phone number, email address, gender, age, yearly income, ‘economic stability,’ marital status, education level, app affinity, and interests and behaviors.”). According to the FTC, Kochava’s data sales harm consumers in two distinct ways. First, by putting them at an increased risk of suffering secondary harms,

such as stigma, discrimination, physical violence, and emotional distress. And

2 To be clear, Kochava adamantly disputes the truth of this allegation. Def.’s Memo. in Supp. Of Motion for Sanctions Under Rule 11 at 9, Dkt. 40-1 (“Kochava’s customers neither do nor can they purchase all of this data, which are all separate, non-overlapping feeds and products without linkages to one another.”). But, of course, this is not the time for resolving factual disputes. second, by invading their privacy. The FTC has alleged facts sufficient to proceed under both theories.

2. Theory #1: Increased Risk of Secondary Harms First, the FTC claims that Kochava’s practices expose consumers to significant risks of secondary harms, including “stigma, discrimination, physical

violence, [and] emotional distress.” Am. Compl. ¶ 97, Dkt. 26. By using Kochava’s precise geolocation data, the FTC explains, Kochava’s customers can target consumers who have visited certain sensitive locations. Id. ¶ 98. The FTC identifies two factors that “exacerbate[]” those risks. First, the “lack of controls

surrounding who accesses this data, and how those entities use it.” Id. ¶ 99. And second, Kochava’s practice of linking geolocation data to MAIDs and thereby making it “easy” to “identify[] consumers by name or other identifying

information[.]” Id. ¶ 100. Unlike the original Complaint, the Amended Complaint contains allegations that the targeting of consumers based on geolocation data “has and does occur.” Id. ¶ 101. To illustrate, the FTC provides several real-world examples of harms

inflicted on device users due to the disclosure of their geolocation and app-use data. Id. ¶¶ 101 & 104–05. Kochava responds that none of the FTC’s “anecdotes” involve its own data. Def.’s Reply at 7, Dkt. 51. But that misses the point. Under

Section 5(n), the FTC must allege that Kochava’s acts or practices cause or are likely to cause substantial injury to consumers. 15 U.S.C. § 45(n). By demonstrating that harms have resulted from the sale of similar mobile device data,

the FTC supports its claim that Kochava’s practices are likely to cause consumer injury.3 In sum, the FTC plausibly alleges that Kochava causes or is likely to cause

substantial injury to consumers by selling “massive amounts of private and encyclopedic information” that puts consumers at a significant risk of suffering secondary harms. Pl.’s Resp. at 1, Dkt. 45. 3. Theory #2: Invasion of Privacy

The FTC’s second theory of consumer injury is also plausible. Kochava’s practices arguably inflict a substantial injury on consumers by invading their privacy. As this Court previously explained, privacy has long been a legally

protected interest at the state, local, and federal levels. See Mem. Decision and Order at 19, Dkt. 24. Accordingly, an invasion of privacy may constitute an injury that gives rise to liability under Section 5(a). Id. The remaining question is simply

3 Kochava also argues that the alleged consumer injury “is not caused by Kochava but instead by some unknown third parties.” Def.’s Memo. in Supp. at 10, Dkt. 33-1. However, as the Court already explained, Section 5(a) does not require that the defendant be the one actually inflicting the ultimate harm. See Mem. Decision & Order at 15–16, Dkt. 24 (“[A] defendant can ‘cause’ substantial injury under Section 5(n) merely by creating ‘a significant risk of concrete harm.’”) (quoting Neovi, Inc., 604 F.3d at 1157). whether the alleged privacy intrusion rises to the requisite level of “substantial” injury. See id. at 22. It does.

Both the United States Supreme Court and the Ninth Circuit Court of Appeals have recognized the unique threat that modern technology can pose to privacy rights. See Patel v. Facebook, Inc., 932 F.3d 1264, 1272 (9th Cir. 2019)

(“[A]dvances in technology can increase the potential for unreasonable intrusions into personal privacy.”). In Carpenter v. United States, for example, the Supreme Court addressed the expectation of privacy in cell phone location records. 138 S.Ct. 2206, 2217 (2018).4 The Court explained that cell phones have become

“almost a feature of human anatomy,” and consequently, historic cell phone location data—unlike the real-time GPS monitoring at issue in United States v. Jones, 565 U.S. 400 (2012)—“provides an intimate window into a person's life,

revealing not only his particular movements, but through them his ‘familial, political, professional, religious, and sexual associations.’” Id. at 2217–18 (internal quotations omitted). The Ninth Circuit recently applied the principle from Carpenter in a case

more factually similar to this one. See In re Facebook, Inc. Internet Tracking

4 Although Carpenter arose in the Fourth Amendment context, the Ninth Circuit has “found analogies to Fourth Amendment cases applicable when deciding issues of privacy related to technology.” In re Facebook Internet Tracking Litig., 956 F.3d 589 (9th Cir. 2020). This Court does, too. Litigation, 956 F.3d 589 (9th Cir. 2020). There, social media users sued Facebook for using plug-ins to track their internet browsing histories across third-party

websites, and for compiling that data into “personal profiles which [were] sold to advertisers to generate revenue.” Id. at 596. The court denied Facebook’s motion to dismiss and held that compiling “highly personalized profiles from sensitive

browsing histories and habits” plausibly constituted a “highly offensive” invasion of privacy. Id. at 606. Indeed, the court explained, modern technology has enabled the collection of “otherwise unknowable” information that “‘implicates privacy concerns’ in a manner different from traditional intrusions as a ‘ride on horseback’

is different from ‘a flight to the moon.’” Id. at 603 (quoting Patel, 932 F.3d at 1273). Kochava allegedly provides its customers with vast amounts of essentially

non-anonymized information about millions of mobile device users’ past physical locations, personal characteristics (including age, ethnicity, and gender), religious and political affiliations, marital and parental statuses, economic statuses, and more. In doing so, Kochava does not merely sell “bits and pieces” of data that are

available through other lawful means. See In re Google Location History Litig., 428 F.Supp.3d 185, 198 (N.D. Cal. 2019). Rather, it sells comprehensive, aggregated collections of raw and synthesized data designed to give its customers a

“360-degree perspective” on the unique traits of millions of individual device users. Am. Compl. ¶ 80, Dkt. 26. This alleged invasion of privacy—which is substantial both in quantity and quality—plausibly constitutes a “substantial

injury” to consumers. See Neovi, Inc., 604 F.3d at 1157 (“An act or practice can cause substantial injury by doing a small harm to a large number of people.”) (internal quotation omitted).

Kochava emphasizes that its data only inferentially reveals information about device users. This Court previously noted that inferences based on geolocation data, alone, can be unreliable. See Mem. Decision & Order at 22–23, Dkt. 24. But that conclusion is less applicable to the allegations in the FTC’s

Amended Complaint. According to the FTC’s new allegations, Kochava itself makes inferences about consumers, rather than simply providing raw data from which its customers could make inferences. See Pl.’s Resp. at 16–18, Dkt. 45.

Moreover, those inferences are generally more reliable than inferences drawn solely from geolocation data. For example, data revealing a device user’s daily use of an app specifically designed to track and manage cancer treatments leaves little to the imagination.

4. Conclusion In sum, the FTC claims that Kochava sells vast amounts of “highly granular” personal information about millions of people in a format that is essentially non-

anonymized. Pl.’s Resp. at 3, Dkt. 45. That data can reveal a person’s political and religious affiliations, sexual orientation, medical conditions, and much more. By selling that data, Kochava arguably invades consumers’ privacy and exposes them to significant risks of secondary harms. Accordingly, the FTC has stated a plausible claim under Section 5(a) of the FTC Act, and the Court will deny Kochava’s request to dismiss this case. ORDER IT IS ORDERED that Kochava’s Motion to Dismiss First Amended Complaint Pursuant to Fed. R. Civ. P. 12(b)(6) (Dkts. 33 & 34) is DENIED.

tes DATED: February 3, 2024 0. : :

My te, □□ ph As B. Lynn Winmill CHOI U.S. District Court Judge

MEMORANDUM DECISION AND ORDER - 14