A location-data settlement shields clinic visits, but the broker market remains

The FTC barred broker Kochava from selling sensitive location data without consent, yet the settlement binds only the named companies.

In May, the Federal Trade Commission settled with Idaho-based data broker Kochava and a subsidiary. The companies may no longer sell, share or disclose sensitive location data without consumer consent. The FTC began investigating in 2022 and alleged that Kochava sold location data from hundreds of millions of mobile devices, enough to trace visits to hospitals, churches and abortion clinics. Kochava did not respond to requests for comment.

The gap this fills is real. Location data emitted by phones at hospitals, abortion clinics or AA meetings is not covered by HIPAA. Brokers can combine it with other data and infer health conditions, then sell the result to advertisers. Chris McQueen of San Diego finished leukemia treatment about 18 months ago. He says he still gets ads for juice cleanses, 'natural' treatments and Mexican clinics, and that they showed up during oncology visits and monthly bloodwork.

This matters for access to care. If people fear that a clinic visit will be tracked and monetized, some may avoid seeking care. A 2022 American Medical Association survey found over 92% of patients believed their health data should not be purchasable. Limiting these sales protects that trust.

The protection is thin so far. Privacy advocates note that FTC settlements bind only the named companies. Privacy Rights Clearinghouse and the EFF identified 750 data brokers operating in the US as of last year. A Stanford study found only 9% comply with a California law giving rights to delete, correct and learn about sold data. Newsom vetoed a bill on Sept. 27 that would have blocked sale of location data, saying it went 'a step too far'. Connecticut, Delaware, Maryland, New Jersey, Oregon and Virginia have banned sale of precise geolocation data. Consumer Reports released model state legislation in January. Ad groups dispute that location data alone is sensitive, and digital advertisers have lobbied states against limits.

Source: KFF Health News