Senior Fellow Seth Frotman and colleagues Stephanie Nguyen and Robin Moore have penned an incisive review of the Federal Trade Commission's recent settlement with Kochava, a company that sells location and behavioral data sourced from hundreds of millions of mobile devices. The authors of the piece in the Yale Journal on Regulation observe that FTC v. Kochava affirms key legal precedents, including solidifying privacy invasion as injury and removing the requirement for actual harm. However, the authors note that this settlement represents a retreat from the FTC's 2024 order against X-Mode Social.
Specifically, they note that the Kochava order leaves critical consumer protection gaps by (1) narrowing the definition of sensitive locations; (2) failing to ban internal data usage, and (3) omitting strict data retention limits.
Frotman and his colleagues conclude that "[u]ntil regulators and policymakers can address these [gaps], dangerous uses of consumer data will continue to go unchecked." They close by observing that "[l]aw enforcement and regulators already have many of the [necessary] tools. Now they need to use them."
Read the full notice and comment, “FTC’s Kochava Settlement Advances Data Privacy Enforcement–But Leaves Critical Gaps in Protecting Consumers,” here