## Facts

- The Federal Trade Commission (FTC) sued Kochava, Inc., a data broker, under § 13(b) of the FTC Act seeking permanent injunctive relief for alleged “unfair” practices under § 5(a), as limited by § 5(n).
- The FTC alleged Kochava collected data originating from consumers’ mobile phones (including through purchases from other data sources) and sold it to customers in ways that could be tied to persistent device identifiers, such as mobile advertising IDs (MAIDs).
- After the court dismissed the FTC’s original complaint for insufficient factual allegations (while permitting amendment), the FTC filed a First Amended Complaint with added detail.
- The amended complaint described four Kochava products: (1) geolocation data showing consumers’ movements; (2) a database “graph” containing detailed consumer profiles (including attributes such as names, addresses, ethnicity, education, and employment); (3) an “app graph” showing app downloads and app use; and (4) “audience segments” grouping consumers by characteristics or interests.
- The FTC alleged that, alone or combined with other readily available information, the data Kochava sold could be used to identify and track individuals and to infer intimate facts about them.
- The FTC alleged the data could reveal visits to sensitive locations and thereby suggest personal characteristics or conditions (such as religious practice, political affiliation, medical conditions, or sexual orientation).
- The FTC advanced two harm theories: (1) risk of “secondary” harms by third parties (for example, targeting, harassment, discrimination, or physical danger) if customers or downstream users used the data to single out individuals; and (2) direct privacy injury from the dissemination of sensitive, linkable information.
- To support plausibility, the FTC included examples of geolocation data being used to target individuals, even though the cited examples were not alleged to involve Kochava’s data.
- Kochava moved to dismiss the First Amended Complaint under Rule 12(b)(6), arguing that the FTC still failed to plead a substantial injury (or likelihood of substantial injury) and that any downstream harms depended on independent third-party misconduct.

## Issues

1. Whether the FTC’s First Amended Complaint plausibly alleged an “unfair” act or practice under § 5(a) and § 5(n) by pleading that Kochava’s data collection and sales cause, or are likely to cause, substantial injury to consumers.
2. Whether alleged injuries based on third-party misuse can satisfy the unfairness standard at the pleading stage, or whether third-party conduct breaks causation as a matter of law.
3. Whether the FTC plausibly alleged the remaining § 5(n) elements—that consumers could not reasonably avoid the injury and that countervailing benefits to consumers or competition did not outweigh the alleged harms.

## Decision

- The court denied Kochava’s motion to dismiss the First Amended Complaint.
- The court rejected the argument that Kochava could not be liable because it was not the party that would directly inflict downstream harms; § 5(a) does not require the defendant to be the actor committing the final harmful act.
- The court held the FTC plausibly alleged substantial injury (or likely substantial injury) based on serious privacy invasion from the sale of sensitive, linkable geolocation and related profile data, along with a significant risk of concrete secondary harms by third parties.
- The court found that the added factual detail in the amended complaint—describing the products, the sensitivity of what could be inferred, and how such data can be used—pushed the allegations from merely possible to plausible under Rule 12(b)(6).
- The court also concluded the FTC plausibly alleged that consumers could not reasonably avoid the challenged practices and that, at the pleading stage, the FTC sufficiently alleged the harms were not outweighed by benefits to consumers or competition.

## Legal Principles

- Under § 5(n), an “unfair” practice is one that causes or is likely to cause substantial injury to consumers that is not reasonably avoidable and is not outweighed by countervailing benefits to consumers or competition.
- A defendant need not personally carry out the ultimate harmful act for an unfairness claim; creating a significant and non-trivial risk of consumer injury through one’s practices can be enough at the pleading stage.
- Substantial injury is not limited to out-of-pocket loss; severe privacy harm tied to the disclosure of sensitive, linkable location and profile data can qualify, particularly where the allegations describe serious consequences that can follow from identification and tracking.
- At the motion-to-dismiss stage, the complaint must allege facts that make injury and causation plausible, not merely speculative; courts assess the pleaded product features, sensitivity of the data, and realistic misuse pathways.
- Reasonable avoidability may be plausibly pleaded where consumers lack meaningful notice or control over collection and resale of their mobile-derived data through intermediaries.
- On countervailing benefits, a plaintiff need not disprove every possible benefit at the pleading stage; it is enough to plausibly allege that the harms outweigh any benefits to consumers or competition.

## Conclusion

The court held that the FTC’s amended allegations stated a plausible § 5(a) unfairness claim: selling sensitive, linkable geolocation and related profile data can inflict substantial privacy injury and expose consumers to serious risks of misuse by others, and the FTC plausibly pleaded the other § 5(n) elements, so the case proceeded past dismissal.


Federal Trade Commission v. Kochava, Inc., 715 F. Supp. 3d 1319 (2024)