“Kochava brags that its Database Graph identifies ‘over 300M unique individuals in the US’ with up to ‘300 data points that can be tied to those profiles.'”

💡 Kochava profiles nearly the entire U.S. population with hundreds of sensitive data points each, demonstrating the massive scale of surveillance.

“Kochava promises its customers that the data is so precise that it accurately places consumers’ movements to within only a few meters – enough to not only tell what building the consumers are in, but even what room.”

💡 This level of precision turns every building into a transparent box, exposing even the most private indoor activities.

“Kochava itself concedes that this data is not anonymous, but rather can be, and is, used to track and identify individual consumers.”

💡 Kochava’s own admission destroys any claim that Mobile Advertising IDs provide privacy protection.

“In many cases, Kochava provides data that directly links this precise geolocation data to identifying information about individual consumers, such as names, addresses, email addresses, and phone numbers.”

💡 Kochava eliminates any technical barrier to identifying consumers, making tracking both comprehensive and immediately actionable.

“Kochava’s precise geolocation data can be used to identify consumers who have visited an abortion clinic and, as a result, may have had or contemplated having an abortion. In fact, in just the data Kochava made available in the Kochava Data Sample, Plaintiff identified a mobile device that visited a women’s reproductive health clinic and traced that mobile device to a single-family residence.”

💡 This is the FTC demonstrating with actual data that Kochava enables tracking of one of the most sensitive and legally precarious medical decisions.

“As another example, the data can be used to track consumers to places of worship, and thus reveal the religious beliefs and practices of consumers. In fact, Plaintiff identified in the Kochava Data Sample mobile devices that were located at Jewish, Christian, Islamic, and other religious denominations’ places of worship.”

💡 Kochava’s data exposes religious affiliations, putting consumers at risk of discrimination and extremist targeting.

“As another example, the data can be used to track consumers who visited a homeless shelter, domestic violence shelter, or other facilities directed to at-risk populations. This information can reveal the location of consumers who are escaping domestic violence or other crimes.”

💡 This tracking capability directly endangers people fleeing abuse by potentially revealing their safe locations to abusers.

“In fact, Plaintiff identified in the Kochava Data Sample a mobile device that appears to have spent the night at a temporary shelter whose mission is to provide residence for at-risk, pregnant young women or new mothers.”

💡 Kochava’s data exposes the most vulnerable populations, including minors in crisis seeking confidential shelter.

“A purchaser could use an ordinary personal email address, identify the company as ‘self,’ and describe the intended use simply as ‘business.’ The request would then be sent to Kochava for approval. Kochava has approved such requests in as little as 24 hours without any additional inquiries or requesting additional information about the purchaser or their intended use.”

💡 Kochava placed almost no barriers between sensitive consumer data and anyone with an email address and a credit card.

“Kochava emphasizes its ability to identify individual consumers by bragging that: ‘the Collective can tie the IDs to a single user using a match key (e.g., email address, phone number, mobile advertising ID [MAID], cookie, addresses, etc.) for one-to-one advertising’ (emphasis added).”

💡 Kochava explicitly markets the ability to target individual named people, not anonymous aggregated groups.

“We determine a home location by looking at the resting lat/long of a given device between the hours of 10pm and 6am and omit known business locations.”

💡 Kochava openly tells customers it can identify where people sleep, revealing home addresses from location data alone.

“In a news article about Kochava’s data, Kochava’s Chief Executive Officer, Charles Manning, criticized, on privacy grounds, a competitor’s use of precise geolocation data to publicly track the spread of COVID: ‘But one of the challenges I saw in that demo, although it was very slick and very appealing to watch, there was really no notion of anonymized, aggregated date there. You’re looking at specific devices.’ Mr. Manning made such criticism despite Kochava’s own collection, use, and sale of precisely the same type of data and the company’s lack of any meaningful controls for the use of that data.”

💡 Kochava’s CEO publicly acknowledged that this type of tracking identifies specific individuals, then sold the same data himself.

“In exchange for the free use of Kochava’s FAA SDK, Kochava requires app developers to agree to grant Kochava a ‘perpetual, irrevocable, worldwide, transferrable unrestricted license’ to consumer information collected via the FAA SDK. Kochava’s license even survives a termination of the agreement between Kochava and the app developer, allowing Kochava to use the data forever.”

💡 Kochava structured contracts to ensure it would own consumer data permanently, regardless of what happens to the apps that collected it.

“Consumers do not expect or want data brokers to collect their precise geolocation data. Indeed, data brokers’ collection, aggregation, and disclosure of location data violate consumers’ expectations of privacy. Consumers disapprove even more strongly when entities collecting their location data use it to make inferences about them. Consumers also do not consent to such collection or disclosure. And because consumers do not know that Kochava is collecting this data, consumers cannot avoid the harm resulting from the collection, use, or subsequent disclosure.”

💡 The FTC establishes that consumers have no realistic way to prevent this surveillance because they don’t know it’s happening.

“In or around July 2023, Kochava transferred at least part of its data broker business to its wholly-owned subsidiary, Defendant Collective Data Solutions, LLC (‘CDS’). CDS continues Kochava’s practices of collecting, using, and disclosing enormous amounts of private and sensitive information about consumers, including, on information and belief, the data feeds and products discussed below.”

💡 Kochava responded to enforcement by creating a subsidiary to continue the same practices, attempting to diffuse legal liability.