Why Kochava? FTC Salvo Against Data Broker Puts Mobile Ad Tech on the Defensive

Earlier this week, the Federal Trade Commission sued ad-tech firm Kochava for selling data that violates user privacy. It alleges that the company allows access to identifiable data about people’s visits to reproductive health clinics, places of worship, addiction treatment centers and other sensitive locations. Experts have been wondering why the FTC has singled out Kochava, relatively a smaller ad-tech firm, when it is one of a number of companies that tracks location data. “There is an enormous quantity of attribution companies in ad tech,” that the FTC could target, said Irene Knapp, a former Google engineer who now works with tech watchdog non-profit Tech Inquiry. Knapp adds that the same scrutiny could be applied to the industry writ large. “The FTC could honestly go after any company in ad tech and have a solid case.” The regulator's choice to target Kochava gives insight into what subsectors may next be in the regulatory crosshairs. But it's the company's strength in attribution that is making it—and other firms—a target of the agency. As more businesses are waking up to becoming more privacy conscious, driven by consumer demand, companies' revenue lines are under scrutiny—and what is an acceptable signal to use to target advertising is being redefined. The suit comes as there is new government scrutiny on the accessibility of personal data, especially as the overturn of Roe v. Wade means more individual actions will be in the purview of law enforcement. The FTC in particular, earlier this month, announced it was exploring rules to crack down on “commercial surveillance” or “the business of collecting, analyzing and profiting from information about people.” Mobile attribution in the spotlight Ad-tech sources who spoke to Adweek said that Kochava is first and foremost a mobile attribution company, meaning it helps mobile advertisers understand who saw their ads and took actions as a result of them. The particular kinds of data that Kochava uses, especially location data, distinguish it from some of its competitors. Kochava has rejected the FTC’s characterization of its business, filing a pre-emptive lawsuit against the regulator earlier this month. The company has also introduced a new product called Privacy Block, available at the end of the third quarter, which removes health services location data from its marketplace. “This lawsuit shows the unfortunate reality that the FTC has a fundamental misunderstanding of Kochava’s data marketplace business and other data businesses,” said Brian Cox, the company's general manager. “Kochava operates consistently and proactively in compliance with all rules and laws, including those specific to privacy.” Sharing granular data vs aggregated data Kochava competes with other mobile attribution companies, such as Adjust and AppsFlyer, multiple sources told Adweek. These firms help brands measure outcomes resulting from mobile ads, though Kochava helps measure using third-party location data. Both Adjust and AppsFlyer say they don't collect precise location data. The companies also stressed they do not sell clients' data. Kochava also runs a separate data marketplace business—unlike Adjust and AppsFlyer—and is a registered data broker under California law. However, it provides more raw data to its customers than its competitors, sources say. “[Other mobile attribution companies are] firing out conversion events and there’s conversion fraud and people don’t get the raw data,” said privacy researcher Zach Edwards, noting that the firm's stores of data allow it to be more accurate. “With Kochava you get the raw data to double check it. … [it] is a preferred attribution vendor to all these aggressive buyers.” An industry executive, who requested anonymity so as not to breach legal agreements, said that customers from Kochava's core mobile attribution business receive data in aggregated form. While an advertiser could link their first-party data with the third-party data Kochava collects, it would be rare as most don’t have the need for that sort of complexity. Attribution across devices The FTC complaint alleges that Kochava made available a free data sample to anyone with a free Amazon Web Services account. The data included latitude and longitude coordinates associated with particular mobile identifiers, which identify particular devices. A comparison of the types of data the firm promotes on its website with the offerings of competitors reveals it has more granular stores of information, according to Knapp. “The things Kochava is offering pretty much all involve some form of novel tracking technology,” they said. Granularity can be a double-edged sword; Edwards and a second ad-tech industry source, who requested anonymity to protect industry relations, said Kochava’s strength as an ad-tech firm is its expertise in attribution. The second source noted that the company is particularly effective at attributing the user across devices, a goal for the measurement industry, as long as the data is given by consent. But as data goes through more hoops, it is also more liable to risk. “If you [attribute] through the ID or the device, that’s one thing,” the second source said. “If you’re trying to bridge to the human being across devices then that’s a worthy pursuit … [unless] the [user] doesn’t agree,” at every step of the way. This article was updated to reflect that Adjust does not sell clients' data. Advertisers at Risk of Unknowingly Collecting Children’s Data, Violating COPPA Laws