Everything, everywhere, all at once

The FTC sued Idaho-based data broker Kochava yesterday, alleging the company sold geolocation data from hundreds of millions of US mobile devices that could be used to identify and track individual consumers.

📊 More deets… Like many other ad tech firms, Kochava purchases vast troves of location data, then packages it into customized feeds. These feeds are sold to customers, like advertisers or retailers looking at foot traffic in their stores.

And while the business model itself is perfectly legal, Kochava is accused of breaking the law by failing to properly anonymize its data – meaning it’s possible to deduce a person’s actual identity based on the company’s information.

• The FTC said it analyzed a Kochava data sample of 61+ million mobile devices – which featured each device’s unique ID number, matched with their time-stamped latitude and longitude locations (including reproductive health clinics, homeless/domestic violence shelters, and places of worship).

🔄 On the flip side: Kochava said the FTC “has a fundamental misunderstanding” of how the data marketplace business works, and that the company has complied with all rules and laws, especially those pertaining to privacy. It actually sued the FTC earlier this month, saying the agency was wrongfully alleging it of violating consumer protection laws, per WaPo.

📸 Big picture: There's growing concern over the sharing of identifiable health data by organizations covered by HIPAA, which places restrictions on uses and disclosures of identifiable protected health information, HIPAA Journal reports. At least two lawsuits have been filed recently against healthcare providers for privacy violations.

• And since SCOTUS’s scrapping of Roe v. Wade in June, privacy experts have warned that search histories, period tracking apps, and location data could be used by law enforcement to prosecute abortion seekers in jurisdictions where it’s no longer legal.

👀 Looking ahead… The FTC is currently considering new rules aimed at addressing data security and commercial surveillance, similar to the EU’s GDPR.