Federal Trade Commission v. Kochava, Inc., 715 F.Supp.3d 1319

The Federal Trade Commission (FTC) brought an action against Kochava, Inc., alleging violations of Section 5(a) of the Federal Trade Commission Act by aggregating and selling sensitive, non-anonymized data from mobile devices.
This data allegedly includes geolocation information, device identifiers, and detailed profiles linking personal characteristics (e.g., names, ethnicity, medical info, app usage, and interests) to individuals.
FTC seeks a permanent injunction, claiming Kochava's practices facilitate privacy invasions and substantial risk of secondary harms (stigma, discrimination, violence).
The original complaint was dismissed for lack of sufficient allegations showing a "significant risk" of substantial injury to consumers; FTC was granted leave to amend.
The Amended Complaint adds factual detail about data products and links real-world examples of harm from similar practices to support both the risk of harm and privacy theories.
Kochava moved to dismiss again, arguing that the deficiencies remain unaddressed, but the Court denied the motion, finding plausible claims under both theories.

Issue	Plaintiff's Argument	Defendant's Argument	Held
Substantial risk of harm	Data sales enable identification and harm; significant risk of secondary injury (stigma, violence)	No evidence Kochava's data used to cause direct harm; risks are insufficiently alleged	FTC plausibly alleges significant risk exists
Invasion of privacy	Selling non-anonymized, granular personal data constitutes a substantial intrusion into personal privacy	Privacy loss alone not substantial; inferences based on location data are unreliable	Quantity and quality of privacy loss is substantial
Pleading sufficiency	Amended allegations provide detailed examples and factual support for plausible consumer injury	Added facts don't overcome original deficiencies; still too speculative	Complaint meets plausibility standard
Linkage between data sets	Collections are linked or easily linkable, facilitating identification of individuals	Data sets are not interconnected; customers can't purchase all info about one person	On a motion to dismiss, allegations credited

Bell Atl. Corp. v. Twombly, 550 U.S. 544 (Supreme Court adopts plausibility standard for pleading)
Carpenter v. United States, 138 S. Ct. 2206 (Expectations of privacy in cell phone location data)
United States v. Jones, 565 U.S. 400 (Use of tracking technology implicates privacy)
Patel v. Facebook, Inc., 932 F.3d 1264 (Advances in technology heighten privacy intrusion risk)
In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589 (Aggregated digital profiles may constitute offensive privacy invasion)
Neovi, Inc. v. FTC, 604 F.3d 1150 (Small harms to many can amount to substantial injury)