Texas Attorney General sues Allstate and Arity for unlawful collection and sale of driving data

Texas Attorney General Ken Paxton has filed a lawsuit against Allstate Insurance and its data subsidiary Arity for allegedly collecting, using, and selling driving data from over 45 million Americans without their consent. The lawsuit, filed in the Montgomery County district court, accuses companies of paying millions of dollars to app developers to secretly embed tracking software in popular mobile apps, thereby gathering consumers’ sensitive location and movement data.

The data was used to profile individuals’ driving habits, influencing car insurance premiums for new quotes or policy renewals. The lawsuit claims this data was also sold to other insurance companies, allowing them to adjust pricing based on consumers’ driving behavior.

“Allstate collected trillions of miles worth of location data from over 45 million consumers nationwide and used the data to create the world’s largest driving behavior database,” the Texas Attorney General’s office stated in an announcement. “When a consumer requests a quote or renewed their coverage, Allstate and other insurers use that consumer’s data to justify increasing their car insurance premium.”

The lawsuit asserts that the companies violated the Texas Data Privacy and Security Act (TDPSA), as consumers were not informed about the data collection, nor did they give consent. The lawsuit further highlights the use of the Arity SDK, a tracking software integrated into popular mobile apps like Life360, GasBuddy, Fuel Rewards, and Routely—apps collectively downloaded over 115 million times from Google Play. The tracking software allegedly gathered location data every 15 seconds, provided users had enabled location permissions upon app installation.

In addition to the app data collection, Allstate and Arity are accused of buying location data directly from several car manufacturers, including Toyota, Lexus, Mazda, Chrysler, Dodge, Fiat, Jeep, Maserati, and Ram. The data collected was purportedly used for the same purpose: profiling drivers for insurance pricing.

The legal action claims that these practices violated multiple Texas laws, including the TDPSA, the Data Broker Law, and the Texas Insurance Code, which addresses unfair and deceptive business practices. The lawsuit seeks several remedies, including civil penalties of up to $7,500 per violation under the TDPSA and $10,000 under the Texas Insurance Code. Additionally, it calls for restitution to consumers affected by these alleged practices, the destruction of unlawfully obtained data, and an injunction to prevent the defendants from continuing such practices.

In response to the lawsuit, a spokesperson for Allstate and Arity stated, "Arity helps consumers get the most accurate auto insurance price after they consent simply and transparently that fully complies with all laws and regulations."