Kochava Final Settlement Includes 6 Business Practice Changes
Kochava must change its business practices as part of a settlement resolving claims the data broker sold location information of app users. A federal judge approved the final settlement Wednesday.
Sign up for a free preview to unlock the rest of this article
Privacy Daily provides accurate coverage of newsworthy developments in data protection legislation, regulation, litigation, and enforcement for privacy professionals responsible for ensuring effective organizational data privacy compliance.
No objections to the proposed settlement were filed, and during a hearing Wednesday, Judge Lynn Winmill of the U.S. District Court for Idaho found it to be “fair, adequate, and reasonable.” The settlement was proposed on Nov. 7.
“The Settlement provides immediate and meaningful injunctive relief that directly addresses the alleged privacy violations at the heart of this case, while preserving each Class Member’s right to pursue individual claims for damages,” the proposed order said.
Case 2:23-cv-00058 centered around allegations that Kochava, without consent, collected and sold sensitive geolocation data of consumers through its software development kits (SDKs).
The settlement requires that the company “immediately” implement six “significant business practice changes that will ensure the privacy violations at the heart of this action are fully remediated.”
This includes the implementation of data-filtering software preventing Kochava from distributing raw location data -- called a privacy block -- as well as ensuring that location data collected through SDKs is only used by the third-party that embedded the SDK in its app.
Additionally, Kochava must deploy an opt-out mechanism; be blocked from misrepresenting the extent to which it collects, maintains, discloses and deletes information; obtain proof of consumer consent from data suppliers; and follow all applicable laws regarding data usage in machine learning.
Beyond these remedial measures, Kochava must pay the costs of the class notice and administration, along with a service award to each plaintiff approved by the court -- up to a total of $17,500 -- and attorneys fees.
In 2022, the FTC sued Kochava for buying and selling sensitive location data from millions of mobile devices (see 2208290052). Kochava argued it was innocent (see 2212050061), even as the FTC sought an injunction against its ability to collect and sell geolocation data (see 2302070037).
The court dismissed the case in May 2023 (see 2305050026), but the FTC filed an amended complaint (see 2307060027) that the judge let stand (see 2402060041).
Kochava was cited as an entity that video-streaming box Roku sold sensitive personal data to in an October lawsuit by the Florida attorney general (see 2510140024).