Fed. Trade Comm'n v. Kochava Inc.
| Decision Date | 04 May 2023 |
| Docket Number | 2:22-cv-00377-BLW |
| Parties | FEDERAL TRADE COMMISSION, Plaintiff, v. KOCHAVA INC., Defendant. |
| Court | U.S. District Court — District of Idaho |
This case is about mobile devices, location data, and privacy. The underlying dispute is whether the defendant, Kochava, Inc. is engaging in an “unfair . . . act or practice” by selling geolocation data that could enable third parties to track mobile device users to and from sensitive locations. At this early stage in the litigation, however, the Court must only decide whether the plaintiff, the Federal Trade Commission (FTC), has stated at least a plausible claim against Kochava.
Before getting into the legal issues, the Court will review the factual allegations underlying the FTC's Complaint.[1]
Kochava, Inc. is a data analytics company that offers various digital marketing and analytics services. One of its services involves aggregating and selling data collected from billions of mobile devices across the world. Among other things, Kochava's data includes timestamped location coordinates and unique device identifiers which, viewed together, reveal the past movements of mobile devices.
Geolocation data is a broad term for information about a mobile device's geographical location. It may reveal where a device currently is, as with Global Position Systems (GPS), or it may only reveal where a device has been in the past. Real-time and historical geolocation data are used by various commercial and governmental entities in many ways. Familiar uses include the use by emergency dispatch to track 9-1-1 callers and the use by cellphone applications that provide turn-by-turn driving directions and traffic alerts. A less visible but equally ubiquitous use of geolocation data is by data analytics companies who analyze consumer trends and develop targeted marketing strategies.
Kochava is one such data analytics company. It obtains geolocation data from third-party data brokers, such as app developers, who collect the data with consent directly from mobile device users. Kochava then aggregates the data in its proprietary data bank, called the Kochava Collective, and lets its paying customers access the data bank. The data bank contains data from “billions of devices globally” and includes around ninety-four billion coordinates per month, from thirty-five million daily active users, with each device generating an average of over ninety data points per day. Compl. ¶ 11, Dkt. 1. That means the location coordinates in the data bank reveal where each mobile device has been approximately every fifteen minutes.
Kochava does not, however, sell real-time location data. Instead, according to the FTC, Kochava's customers can only access “historical location data” collected during the seven days prior to the date they pay for access to the data bank. Id. ¶ 19. Thus, while Kochava's customers can see where a given mobile device has been, they cannot see where a device presently is.
Mobile Advertising IDs (MAIDs) are unique alphanumeric names that operating systems, such as IOS and Android, assign to mobile devices. Acting as virtual fingerprints, MAIDs are also called “unique persistent identifiers” because they remain unchanged unless proactively reset by device users. Id. ¶ 10. In the context of data analytics, MAIDs are used to link a series of otherwise unconnected data points, such as geolocation coordinates, and, hence, reveal the movements of a particular device. In short, by associating data points with MAIDs, analytics companies can identify patterns among specific devices, group devices into categories, and develop targeted marketing campaigns based on that information.
According to the FTC, each set of location coordinates in Kochava's data bank is paired with a MAID. This linking of coordinates to MAIDs, the FTC claims, enables Kochava's customers to plot coordinates on a map and trace a particular device's movements, and in doing so, to “associate each set of coordinates with a specific consumer.” Id. ¶¶ 8, 20-21. It is this practice of selling both geolocation coordinates and MAIDs that the FTC challenges in this lawsuit.
The FTC filed this action in August of 2022, seeking a permanent injunction barring Kochava from continuing its sale of “precise location data associated with unique persistent identifiers that reveal consumers' visits to sensitive locations.” Id. ¶ 36. The Complaint focuses on two components of the data Kochava sells: timestamped geolocation coordinates and MAIDs. According to the FTC, by aggregating and selling both data points, together, without any technical controls to prevent tracking device users to sensitive locations, Kochava violates device users' privacy and exposes them to risks of secondary harm. In doing so, the FTC alleges, Kochava engages in an “unfair . . . act or practice” prohibited by Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45(a)(1). To prevent Kochava from continuing to violate Section 5(a), the FTC seeks a permanent injunction under Section 13(b), 15 U.S.C. § 53(b).
Instead of filing an answer to the FTC's Complaint, Kochava seeks dismissal under Federal Rule of Civil Procedure 12(b)(6) for failure to state a claim upon which relief may be granted. Kochava's Motion to Dismiss (Dkt. 7) is fully briefed and the Court heard oral argument on February 21, 2023. As explained below, the Court will grant the motion to dismiss, but will allow the FTC to file an emended complaint in accordance with this Order.
To survive a motion to dismiss, a complaint must contain sufficient factual matter, accepted as true, to “state a claim to relief that is plausible on its face.” Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 570 (2007). “[D]ismissal may be based on either a lack of a cognizable legal theory or the absence of sufficient facts alleged under a cognizable legal theory.” Johnson v. Riverside Healthcare Sys., 534 F.3d 1116, 1121 (9th Cir. 2008) (cleaned up). However, Rule 12(b)(6) “does not impose a probability requirement at the pleading stage; it simply calls for enough facts to raise a reasonable expectation that discovery will reveal evidence” of the truth of the allegations. Twombly, 550 U.S. at 556.
When a court dismisses a complaint under Rule 12(b)(6), it should generally allow the plaintiff to file an amended complaint unless the complaint clearly “could not be saved by any amendment.” Chang v. Chen, 80 F.3d 1293, 1296 (9th Cir. 1996), overruled on other grounds by Odom v. Microsoft Corp., 486 F.3d 541 (9th Cir. 2007); see also Fed.R.Civ.P. 15(a)(2).
The FTC's Complaint rests on two provisions of the Federal Trade Commission Act (“FTC Act”). First, Section 5(a) provides the underlying legal proscription the FTC seeks to enforce, prohibiting “unfair . . . acts or practices in or affecting commerce.” 15 U.S.C. § 45(a). Second, Section 13(b) provides the enforcement mechanism the FTC employs, authorizing it to seek injunctions in federal court whenever it “has reason to believe” that a person, partnership, or corporation “is violating, or is about to violate,” a law enforced by the FTC. 15 U.S.C. § 53(b).
Kochava offers several reasons why the FTC has failed to make sufficient factual allegations to state a claim under Section 5(a) and 13(b). It also makes several constitutional arguments, asserting that even if the FTC made additional factual allegations, its claim would not survive. Ultimately, the Court agrees that the FTC's complaint lacks sufficient allegations to state a claim under Section 5(a). It is not clear, however, that the deficiencies cannot be cured. The Court will therefore dismiss the Complaint with leave to amend in accordance with this Order.
Under Section 13(b) of the FTC Act, the FTC may only seek injunctive relief when it “has reason to believe” that a defendant “is violating, or is about to violate, any provision of law enforced by the Federal Trade Commission.” 15 U.S.C. § 53(b). In other words, the FTC cannot seek an injunction based only upon past conduct.
Kochava insists that the FTC is only challenging past practices. But in reading the Complaint so narrowly, Kochava misses the forest for the trees. Although the Complaint does repeatedly reference a data sample that is no longer available, it is replete with present and present perfect tense language clearly alleging that Kochava continues to engage in the same practice of selling geolocation data without restrictions near sensitive locations. See Compl. ¶¶ 8, 9, 11, 23, 30, 33, 36, 37 & 39, Dkt. 1; see also Jones v. Liberty Mut. Fire Ins. Co., Civil Action No. 3:04-CV-137-MO, 2008 WL 490584, at *2 (W.D. Ky. Feb. 20, 2008) (). Read properly, the FTC's Complaint alleges that Kochava is actively selling location data in violation of the FTC Act. At this stage, that allegation suffices.[2]
Kochava argues that, to sue under Section 5(a), the FTC must identify some “underlying predicate violation” of law or public policy. The Court disagrees because neither the statutory language nor case law support adding such an element to Section 5(a).
Congress enacted the FTC Act to prohibit “unfair” and “deceptive” business practices that harm competitors and consumers. If those terms...
To continue reading
Request your trial