Why Kochava says it doesn't want to settle with the FTC

Though it may come through, uh...legal...means, a definition of what constitutes “sensitive data” for the ad industry and the FTC may be on the horizon.

Rewind: In August, the FTC and the data broker Kochava sued each other over location data sold by the company that the agency alleged could be used to track consumers “to and from sensitive locations.”

Kochava has argued that these accusations are baseless and claimed that it was planning on removing “sensitive locations” from its data marketplace anyway. Earlier this month, Kochava said the removal went into effect as it unveiled its previously announced Privacy Block tool, which the company said removes the following:

• “Health and wellness service centers and clinics, religious institutions, schools, financial credit institutions, federal buildings, correctional institutions, dependency and addiction treatment centers, homeless shelters, halfway houses, and more.”
• In total, Kochava said it’s eliminating 2.4+ million sensitive locations, the list of which came from a third party that the company declined to share with Marketing Brew.

But wait, there’s more: Charles Manning, Kochava’s CEO, told us that prior to the lawsuits, Kochava was offered a proposed consent order from the FTC in July—basically, a settlement—that “was built entirely around actually blocking…sensitive health locations.” (When asked, Kochava declined to share a copy of the proposed consent order “given the active litigation.”)

According to Manning, the data broker asked for clarity on the definition of “sensitive health locations” before the litigation, and in his view, “the FTC refused to clarify,” so Kochava sued.

“What we’re not willing to agree to is a settlement that is ambiguous,” Manning said.

He claimed it wasn’t until the FTC filed its lawsuit against Kochava that the agency offered specific examples of sensitive locations like:

• “Including, among others, locations associated with medical care, reproductive health, religious worship, mental health, temporary shelters, such as shelters for the homeless, domestic violence survivors, or other at-risk populations, and addiction recovery.”
• FTC spokesperson Juliana Gruenwald noted that “since at least 2012, the FTC has publicly stated that precise location data, of the type sold by Kochava, is sensitive information,” and pointed Marketing Brew to a 2012 privacy report in which the FTC said that “when health or children’s information is involved, for example, the likelihood that data misuse could lead to embarrassment, discrimination, or other harms is increased.”

Megan Gray, founder and CEO of GrayMatters Law & Policy and a former FTC attorney, isn’t buying Manning’s claim that Kochava couldn’t get specificity from the FTC, pointing out that a proposed consent order is often negotiable.

“If they’re now doing what the FTC said they had to do, there’s no reason to be litigating,” she said, referring to Kochava's creation of Privacy Block in August.

So why not just settle? Manning believes that a settlement with a consent decree would still have been a problem, claiming that it would not have been specific enough. “We have broken no rules to get us to the place that we’re at.”

Back to standards

The Network Advertising Initiative, an industry trade group of which Kochava is not a member, proposed and released its own voluntary standards in June regarding “restrictions on the use, sale, or transfer” of location data tied to “religious worship, sensitive healthcare services, military bases, LGBTQ+ identity, and other places.”

Already, PlaceIQ, Foursquare, and Cuebiq have agreed to adopt these standards, but none of the NAI’s dozens of other members, including Google, Microsoft, Criteo, and Neustar, have signed on.

So, the industry is seemingly moving (at least publicly) in a direction that is beginning to more precisely define what a “sensitive location” actually is. But it might take a law to force everyone else to adopt these measures.

“There’s a difference between best practice and what is legally required,” said Gray.

“I think the FTC wants a black-and-white rule that [says] this is not optional, that companies must implement a privacy filter.”