One of the world's largest mobile data brokers, Kochava, has lost its battle to stop the Federal Trade Commission from revealing what the FTC has alleged is a disturbing, widespread pattern of unfair use and sale of sensitive data without consent from hundreds of millions of people. US District Judge B. Lynn Winmill recently unsealed a court filing, an amended complaint that perhaps contains the most evidence yet gathered by the FTC in its long-standing mission to crack down on data brokers allegedly "Substantially" harming consumers by invading their privacy. The FTC has accused Kochava of violating the FTC Act by amassing and disclosing "a staggering amount of sensitive and identifying information about consumers," alleging that Kochava's database includes products seemingly capable of identifying nearly every person in the United States. According to the FTC, Kochava's customers, ostensibly advertisers, can access this data to trace individuals' movements-including to sensitive locations like hospitals, temporary shelters, and places of worship, with a promised accuracy within "a few meters"-over a day, a week, a month, or a year. Kochava's products can also provide a "360-degree perspective" on individuals, unveiling personally identifying information like their names, home addresses, phone numbers, as well as sensitive information like their race, gender, ethnicity, annual income, political affiliations, or religion, the FTC alleged. Beyond that, the FTC alleged that Kochava also makes it easy for advertisers to target customers by categories that are "Often based on specific sensitive and personal characteristics or attributes identified from its massive collection of data about individual consumers." These "Audience segments" allegedly allow advertisers to conduct invasive targeting by grouping people not just by common data points like age or gender, but by "Places they have visited," political associations, or even their current circumstances, like whether they're expectant parents. Or advertisers can allegedly combine data points to target highly specific audience segments like "All the pregnant Muslim women in Kochava's database," the FTC alleged, or "Parents with different ages of children." "Kochava's use and disclosure of this precise geolocation information invade consumers' privacy and cause or are likely to cause consumers substantial injury," the FTC's amended complaint said. Kochava collects, uses, and discloses enormous amounts of additional private and sensitive information about consumers. Kochava's use and disclosure of this data, whether alone or in conjunction with Kochava's geolocation data, also invade consumers' privacy and cause or are likely to cause consumers substantial injury." According to the FTC, Kochava obtains data "From a myriad of sources, including from mobile apps and other data brokers," which together allegedly connects a web of data that "Contains information about consumers' usage of over 275,000 mobile apps." The FTC alleged that this usage data is also invasive, allowing Kochava customers to track not just what apps a customer uses, but how long they've used the apps, what they do in the apps, and how much money they spent in the apps, the FTC alleged. Kochava "Provides an unprecedented view into a consumer's personal actions, decisions, and behaviors," the FTC alleged, seeming particularly concerned that Kochava collects barely any information from its customers before providing access to this sensitive information. "Kochava's practices intrude into the most private areas of consumers' lives and cause or are likely to cause substantial injury to consumers," the complaint said. Kochava "Could implement safeguards to protect consumer privacy, such as blacklisting sensitive locations from its data feeds or removing sensitive characteristics from its data" at "a reasonable cost and expenditure of resources," but deliberately chooses not to, the FTC alleged. Instead, Kochava "Actively promotes its data as a means to evade consumers' privacy choices," the FTC alleged. Further, the FTC alleged that there are no real ways for consumers to opt out of Kochava's data marketplace, because even resetting their mobile advertising IDs-the data point that's allegedly most commonly used to identify users in its database-won't stop Kochava customers from using its products to determine "Other points to connect to and securely solve for identity."
This Cyber News was published on arstechnica.com. Publication date: Thu, 30 Nov 2023 23:19:27 +0000