An Idaho federal judge on Saturday ruled that a Federal Trade Commission (FTC) enforcement action against the data broker Kochava — which the agency asserts sells vast amounts of non-anonymized data belonging to millions of people — may continue, a reversal of a prior ruling to dismiss the case.

Privacy advocates consider the court decision to be significant for several reasons, including that the case is the FTC’s first against a geolocation data broker to be fought in court. The decision also lays the foundation for a widely anticipated FTC rulemaking on commercial surveillance, which could further limit data brokers’ activities.

The judge found the FTC’s claim that Kochava’s customers can purchase data that is granular and non-anonymized could be a violation of Section 5 of the FTC Act and an “unfair” practice.

Kochava selling the data “invades consumers’ privacy and exposes them to significant risks of secondary harms,” the judge ruled.

According to the FTC, Kochava ties mobile device locations to Mobile Advertising IDs, allowing its customers to “identify specific device users who have visited certain sensitive locations.”

The ruling cites FTC arguments that Kochava customers can draw upon its various “data collections” to identify individuals. The ruling cites an example from the FTC alleging that Kochava combines and packages data that can identify “a woman who visits a particular building, the woman’s name, email address, and home address, and whether the woman is African-American, a parent (and if so, how many children), or has an app identifying symptoms of cancer on her phone.”

The FTC alleges that it is also significant that Kochava customers can obtain this information without needing to couple it with other data sources, the opinion says.

“This is the clearest statement yet by a court that selling location data can be an unfair trade practice,” said John Davisson, the director of litigation at the Electronic Privacy Information Center. “Kochava and other data brokers have built a business off of bootlegging the most sensitive details of our lives.”

The ruling is a “bright red warning to those companies and another boost to the FTC’s efforts to rein in a fundamentally exploitative industry,” Davisson added.

Kochava’s CEO and founder Charles Manning said in a statement that he expected Saturday’s ruling and is “confident we will prevail on the merits.”

“This case is really about the FTC attempting to make an end-run around Congress to create data privacy law,” Manning said. “The FTC’s salacious hypotheticals in its amended complaint are mere scare tactics. Kochava has always operated consistently and proactively in compliance with all rules and laws, including those specific to privacy.”

Prior to the FTC’s lawsuit, Manning said Kochava introduced a Privacy Block, which he called a “sensitive location blocking solution.”

“Through Privacy Block, Kochava has been blocking over 2.1 million locations from its data products on an ongoing basis,” Manning’s statement said. “Never in a million years did we imagine that as a small, law-abiding company we’d find ourselves in the ring on behalf of an entire industry.”

The judge had rejected the FTC’s original complaint against Kochava last year, ruling that the agency had not presented evidence showing Kochava’s practices cause “substantial injury” to consumers. The FTC refiled an amended complaint containing examples of real world harms in June, leading the judge to allow the case to proceed on Saturday.

In November, the judge unsealed the FTC’s allegations in the case.

The decision comes in the wake of two significant FTC settlements with the geolocation data brokers X-Mode and InMarket. In both cases the FTC succeeded at forcing the brokers to agree to substantial changes in their business practices.

The FTC says Kochava sells “essentially” non-anonymized data based on millions of consumers’ mobile devices, including:

• Past physical locations derived from “precise” geolocation data
• Names, addresses, mobile advertising IDs, email addresses and phone numbers
• Personal traits including age, ethnicity and gender
• Religious and political affiliations as well as education level
• Marital, parental and economic statuses, including yearly income and “economic stability”
• “App affinity” (defined as apps installed on consumers’ phones) as well as their “interests and behaviors”

Suzanne Smalley

Suzanne Smalley is a reporter covering privacy, disinformation and cybersecurity policy for The Record. She was previously a cybersecurity reporter at CyberScoop and Reuters. Earlier in her career Suzanne covered the Boston Police Department for the Boston Globe and two presidential campaign cycles for Newsweek. She lives in Washington with her husband and three children.