How Soon Until the Kochava Geolocation Case Catches Up to Medical Device Companies?

We were listening to a radio interview last week with Lina Khan, the Chair of the Federal Trade Commission (“FTC”).  In the interview, Khan spoke about the Commission’s efforts to regulate geolocation data trackers so that they don’t abuse their abilities. The risks she described caught our attention because two of the risk profiles she cited included things that touched on FDA-related entities, such as medical devices that transmit data. See, e.g., here.

“We have taken several actions that just in the last few months that have been making sure we’re protecting people’s sensitive information via geolocation data that people can buy to track with great precision” said Khan, “whether people are going to addiction facilities or places of worship or seeking reproductive health service.”

Khan was referencing a suit that FTC and DOJ filed against Kochava, a prominent location data broker, in August 2022.  The interview aired on Monday, May 1.  The rest of Khan’s week didn’t go as well.

On Thursday, a District Court judge in Idaho issued a pair of mixed rulings relating to the FTC’s case against prominent location data broker Kochava.  The news wasn’t all bad for the government, but FTC’s now has some decisions to make.

Back in the Summer of 2022, FTC approached Kochava about its contemplated suit against the company for violations of the FTC Act.  Kochava decided to strike first and sued the FTC, hoping to preempt the pending enforcement suit.  Undeterred, FTC moved ahead with its case.

When FTC brings data privacy cases against tech companies, it does so under the provisions of the FTC Act that prohibit “unfair or deceptive” practices.  Deceptive practices are the frequent bedrock legal theory for these cases.  Tech companies that don’t live up to their promises to safeguard consumer data are frequent targets of the FTC.

The case against Kochava is a little different.  The complaint does not describe deceptive practices, instead alleging that Kochava was acting unfairly.  According to the FTC and DOJ, the sale of consumers’ geolocation data to publicly accessible on-line data marketplaces is unfair because it potentially puts those consumers at risk.  Advertisers, the complaint says, aren’t the only digital entities hoping to make use of data showing where people go.  Those with more malevolent—unfair?—intent may also exploit that information.  This is what Khan was describing in her interview.

On Thursday, the judge overseeing the parallel cases made two, mixed rulings.  To the benefit of the FTC, the judge permanently dumped the company’s pre-emption suit.  He ruled that it was a “race-to-the-courthouse declaratory action” that Kochava filed without the purpose of “seeking any real affirmative declaratory relief . . . .”  In the court’s opinion, Kochava was asking it to “pre-determine that the FTC anticipated lawsuit would fail.”  While there are some cases where seeking to preclude agency action might work, it would be a remarkable decision for a federal judge to rule on the merits of an enforcement suit before it was filed, as Kochava was asking here.

But the judge also dealt a blow to the government, dismissing its suit against Kochava.  Khan is correct in that one can easily envision how the sale of location data might unfairly put consumers at risk, but the judge in Idaho ruled that the FTC had not effectively alleged facts that show a likelihood of substantial consumer injury.  FTC’s case did not rely on specific instances of realized consumer unfair harm related to the sale of geolocation information.  In this case, the potential for harm was not enough to sustain the suit.

However, FTC may get another crack at this.  The ruling left open the door for FTC to file an amended complaint that relies more on specific factual evidence.  So, the government here has a choice to make.  FTC will need to investigate further and put together some data specific to Kochava, it seems, since they didn’t include it in the first suit. If the parade of horribles they envision isn’t as evincible as it is imaginable, then pressing the suit against Kochava looks to be more challenging.

As a final note, we would note that it doesn’t seem difficult to envision this case affecting many FDA-regulated companies.  We’ve written before (see here too) about how medical device companies are truly data companies to the extent they promote software or are otherwise connected to the internet. By their very nature as regulated medical products, they traffic in data that is similarly sensitive to the geolocation information at issue in the Kochava case.  As FDA continues to both build its cybersecurity and digital health infrastructure and strengthen its cross-agency relationship with FTC, we can’t help but wonder how soon we’ll see an action like this against a device company.