Many state legislatures have been focusing on data broker activities; at the same time the FTC has been pursuing brokers for alleged Section V violations. Most recently, the FTC finalized a case that was brought under the last administration, against Kochava and its data broker subsidiary, Collective Data Solutions.
As we wrote about at the time, the focus for the FTC was on harm resulting from alleged collection and use of profiles based on sensitive information. In resolving the case, the company has agreed not to sell or share sensitive location information without consent. It will also put in place a program to identify sensitive locations by the fall, to ensure that location data tied to those spaces is not sold or shared.
The company also agreed to other measures, including processes to ensure that consumers have provided requisite consent and to give consumers’ names of entities to whom their information might have been sold or shared. The company has also agreed to implement a data deletion/retention schedule and to submit reports to the FTC if third parties have shared precise location data in a way that violates contractual limitations.
Putting It Into Practice: The conclusion of this case has been a long time in coming and underscores the ongoing concerns that regulators and legislators have with data brokers – on both sides of the aisle.