Texas Launches Legal Battle Over Alleged Data Misuse By Allstate

Texas Attorney General Ken Paxton is suing Allstate and its subsidiary Arity for allegedly collecting and selling sensitive data from over 45 million Americans without consent.

At a Glance

Texas has sued Allstate and Arity for unlawful data collection and sale.
The case claims violation of Texas Data Privacy and Security Act.
45 million Americans’ data was allegedly collected without consent.
It’s the first enforcement action under a state-level comprehensive data privacy law.
The lawsuit seeks penalties, data deletion, and prevention of future violations.

Texas Takes Legal Action Against Allstate and Arity

In a landmark case, Texas Attorney General Ken Paxton has filed a lawsuit against Allstate Corporation and its subsidiary, Arity, accusing them of unlawfully collecting, using, and selling sensitive driving and location data from over 45 million Americans, including millions of Texans. This legal action marks the first enforcement under a state-level comprehensive data privacy law by any state attorney general.

The lawsuit alleges that Allstate and Arity violated the Texas Data Privacy and Security Act by failing to inform consumers or obtain their consent before collecting and selling their personal data. Additionally, Arity is accused of not registering as a data broker in Texas, violating both the state’s Data Broker Law and the Texas Insurance Code.

Texas Attorney General Ken Paxton claims Allstate collected the data through mobile apps and by purchasing it from car manufacturers. https://t.co/G5OT4nfIvy

— PCMag (@PCMag) January 14, 2025

Alleged Data Collection Methods and Scope

According to the lawsuit, Arity has been embedding tracking software in mobile apps since at least 2017, collecting detailed driving data without users’ knowledge or consent. The data allegedly collected includes geolocation, accelerometer, magnetometer, gyroscopic data, and driving behaviors such as acceleration and braking patterns.

“Our investigation revealed that Allstate and Arity paid mobile apps millions of dollars to install Allstate’s tracking software,” said Attorney General Paxton. “The personal data of millions of Americans was sold to insurance companies without their knowledge or consent in violation of the law. Texans deserve better and we will hold all these companies accountable.”

The lawsuit claims that Arity incentivizes app developers to use its software by offering bonuses. Furthermore, it alleges that Arity combines data from mobile apps with personally identifiable information to match individuals to driving data, creating what it markets as the “world’s largest driving behavior database.”

Implications for Consumers and Insurance Practices

The collected data is allegedly used by Allstate and other insurers to adjust insurance premiums, potentially affecting consumers based on their own and others’ driving behaviors. This practice raises concerns about fair pricing and consumer privacy rights. The lawsuit suggests that the data could be used to increase premiums or even deny coverage based on driving patterns that may be misinterpreted or taken out of context.

The misuse or leakage of location data poses significant privacy and cybersecurity risks, including potential for stalking, identity theft, and unwarranted surveillance. The sensitivity of this data is underscored by its ability to reveal personal details such as health conditions, religious affiliations, and political views.

Legal Ramifications and Sought Penalties

The Texas Attorney General’s office is seeking severe penalties under the Texas Data Privacy and Security Act, including fines of up to $7,500 per violation. Given the alleged scale of data collection, these fines could amount to substantial sums. The lawsuit also demands that Allstate and Arity delete all improperly obtained data and cease their illegal data practices.

This legal action follows a similar case against General Motors for allegedly selling Texans’ driving data to insurers, indicating a broader initiative by the Texas Attorney General’s office to curb privacy violations by tech-forward corporations. The outcome of this lawsuit could set a significant precedent for data privacy enforcement at the state level and potentially influence similar actions across the country.