FTC Files Suit Over Unrestricted Access to Digital Health Data

The Federal Trade Commission has filed a lawsuit against Kochava, an Idaho-based digital health company whose data analytics platform can be used to, among other things, identify and track women seeking an abortion and abortion providers. 

Federal officials are taking proactive steps to ensure that data on digital health platforms can’t be used to identify women seeking an abortion.

The Federal Trade Commission is wading into the hot-button issue with a lawsuit filed against Kochava, an Idaho-based provider of mHealth app analytics and attribution. The suit alleges that the company has customized its data feeds to allow interested parties to identify the location and identity of mHealth app users through unique device identification numbers and geolocation data, thereby allowing them to target women visiting healthcare provider offering abortion services.

“Where consumers seek out healthcare, receive counseling, or celebrate their faith is private information that shouldn’t be sold to the highest bidder,” Samuel Levine, director of the FTC’s Bureau of Consumer Protection, said in a press release. “The FTC is taking Kochava to court to protect people’s privacy and halt the sale of their sensitive geolocation information.”

In its complaint, the FTC alleges that the company isn't protecting data from mobile apps and devices, "allowing anyone with little effort to obtain a large table of sensitive data and use it without restriction." Using a week's worth of data collected from more than 61 million mobile users by the company, the agency said it was possible to identify and track people in such sensitive places as reproductive health clinics, places of worship, homeless and domestic violence shelters, and addiction recovery centers.

The accusation touches on one of the most divisive issues in the country and a political firestorm. According to the New York Times, since the US Supreme Court's recent decision to overturn Roe v. Wade, 12 states have banned most abortions and two others have banned the procedure after six weeks of pregnancy, while several more are mulling legislation restricting abortion and several ore have taken steps to ensure that abortion is legal.

The FTC points out in its press release that it "has reason to believe that the named defendants are violating or are about to violate the law and it appears to the Commission that a proceeding is in the public interest." The lawsuit places the matter before the courts.

Accessing information on women seeking abortion isn't the FTC's only concern in this action. The agency pointed out that interested parties could also identify healthcare providers who perform or assist in the performance of abortion services, thereby putting their privacy and even their lives at risk.

In addition, interested parties could use the data to track people of different religions, those seeking treatment for sensitive health concerns like addiction issues, HIV/AIDS and sexual health concerns, and people living or working in domestic violence and homeless shelters.

"Identification of sensitive and private characteristics of consumers from the location data sold and offered by Kochava injures or is likely to injure consumers through exposure to stigma, discrimination, physical violence, emotional distress, and other harms," the lawsuit states. These injuries are exacerbated by the fact that … Kochava lacks any meaningful controls over who accesses its location data feed."

"The collection and use of their location data are opaque to consumers, who typically do not know who has collected their location data and how it is being used," the complaint continues. "Indeed, once information is collected about consumers from their mobile devices, the information can be sold multiple times to companies that consumers have never heard of and never interacted with. Consumers have no insight into how this data is used--they do not, for example, typically know or understand that the information collected about them can be used to track and map their past movements and that inferences about them and their behaviors will be drawn from this information. Consumers are therefore unable to take reasonable steps to avoid the … injuries."