Kochava Hit with Class Action Over Collection, Sale of Consumers’ Sensitive Geo-Location Data

New to ClassAction.org? Read our Newswire Disclaimer

A proposed class action alleges mobile analytics firm Kochava has illegally collected and stored California consumers’ precise location data and then sold that information to its clients. 

The 36-page lawsuit’s filing comes less than two weeks after the Federal Trade Commission sued Kochava over its allegedly illegal collection and sale of non-anonymized location data.

In a press release, the FTC specified that the data collected, stored and sold by Kochava can include consumers’ visits to reproductive clinics, medical centers, places of worship, homeless and domestic violence centers, and addiction recovery facilities. The agency alleged that by selling this consumer data, Kochava is enabling others to identify individuals while exposing them to “threats of stigma, stalking, discrimination, job loss, and even physical violence.” 

The consumer complaint, filed on September 6, alleges Idaho-based Kochava has effectively “wiretapped” California residents by collecting, recording and sharing their geo-location data without consent. 

“The collection and sale of such data poses unwarranted and unauthorized intrusion into the most private areas of a consumer’s life and caused or is likely to cause substantial injury to the consumers,” the filing argues. 

After collecting consumers’ location data from their mobile devices, and in some cases buying that information from other data brokers, Kochava then sells “customized data feeds” to its clients for the purposes of targeted advertising and “analyzing foot traffic” at stores, the suit relays. Per the complaint, data disseminated by Kochava includes “timestamped latitude and longitude coordinates” that show the exact location of mobile devices. 

Each pair of timestamped latitude and longitude coordinates is associated with a “device_id_value,” also known as a mobile advertising ID (MAID), the case explains. A MAID is a unique identifier linked to each consumer’s mobile device that’s used by marketers for advertising purposes, the suit says. 

The filing relays that Kochava takes consumers’ geo-location data and combines it with other data to create reports about individual people, namely by “tracking their mobile phone location and corresponding smartphone application and click-thru activity and usage.” 

Kochava’s “huge and diverse” client list includes the likes of 7-Eleven, Airbnb, CBS, Chevron, Disney+, Dunkin Donuts, Hilton Hotels, John Hancock, McDonald’s, NBC, Western Union, SiriusXM, UFC and Venmo, the case says.  

The complaint charges that Kochava “lacks any meaningful control over who accesses its location data feed.” The FTC alleged that Kochava, until at least June 2022, allowed “anyone with little effort to obtain a large sample of sensitive data and use it without restriction.” 

“The data sample the FTC examined included precise, timestamped location data collected from more than 61 million unique mobile devices in the previous week,” the agency said. 

Law360 reports that Kochava Collective data marketplace general manager Brian Cox said last August that the broker had already taken the “proactive step” of announcing a new process to block geo-location data collection from “sensitive locations.” 

The lawsuit looks to cover all individuals in California whose communications or conversations were intercepted and recorded without their consent by Kochava or its agents.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.