District Court Dismisses FTC Complaint against Data Analytics Company

A federal judge in the U.S. District Court for the District of Idaho recently dismissed the FTC’s complaint against a data analytics company.  However, the judge also granted the FTC leave to amend its single claim against the company.

In August 2022, the FTC sued a data analytics company under Section 5(a) of the FTC Act for the alleged unfair sale of sensitive data.  The company aggregates and sells the timestamped geolocation coordinates and Mobile Advertising IDs of device users to third parties.  The FTC alleged that the company engages in unfair acts or practices by selling this data without any technical controls to prevent third parties from tracking device users to sensitive locations, violating the privacy rights of device users and exposing them to risks of secondary harm.  The FTC sought a permanent injunction requiring the company to implement safeguards to stop the sale of such data.

On the company’s motion to dismiss, the federal judge held that the FTC had not adequately alleged a likelihood of substantial consumer injury.  Under its first theory, the FTC alleged that third parties can use the information to identify, track, and harm device users.  However, the court found that the FTC failed to allege that the company’s acts or practices created a significant risk of harm. 

Under the second theory of consumer injury, the FTC alleged that the company’s acts violate consumers’ privacy.  But while intangible invasions of a legally protected interest, including privacy, may constitute injury, the court found that the alleged privacy intrusion did not constitute a substantial injury.  First, the data, on its face, is neither sensitive nor private.  Second, the data is generally accessible through other, lawful means.  Third, the FTC failed to allege the universe of impacted device users.

The court rejected the company’s argument that the FTC had failed to state a claim because it did not identify a predicate violation or allege that the company’s practices were immoral, unethical, oppressive, or unscrupulous.  The court, in following Ninth Circuit precedent, held that Section 5(a) only required the FTC to allege that an act or practice (1) caused or likely caused substantial injury to consumers (2) that was unavoidable by consumers and (3) was not outweighed by countervailing benefits to consumers. 

Finally, the court also rejected the company’s various arguments challenging the constitutionality of the FTC.  The court found that Section 13(b) of the FTC did not violate the separation of powers, relying, in part, on Ninth Circuit precedent.  It also found that the nondelegation and major question questions did not apply because Congress had only granted the FTC authority to seek judicial enforcement of the laws under its purview.

The case is FTC v. Kochava Inc., No. 2:22-cv-00377-BLW (D. Idaho May 4, 2023).