Allstate car insurer sued for tracking drivers without permission

Texas Attorney General Ken Paxton has filed a lawsuit against Allstate and its data subsidiary Arity for unlawfully collecting, using, and selling driving data from over 45 million Americans.

The two companies are accused of paying millions of dollars to app developers to embed tracking code in widely used mobile apps to gather the location and movement data of people without their knowledge or consent.

That data was used to profile people’s driving habits and adjust insurance quoting or renewal costs, allowing the company to identify risks and set the prices accordingly.

Additionally, Allstate and Arity allegedly sold this data to other insurance companies so they could do the same.

“Allstate collected trillions of miles worth of location data from over 45 million consumers nationwide and used the data to create the world’s largest driving behavior database,” reads the Texas AG announcement.

“When a consumer requested a quote or renewed their coverage, Allstate and other insurers would use that consumer’s data to justify increasing their car insurance premium.”

This violates the Texas Data Privacy and Security Act (TDPSA), since the app users were not informed of this targeted data collection and they did not consent to it.

Lawsuit targeting Allstate

The lawsuit, submitted to the Montgomery County district court, mentions the integration of tracking software (Arity SDK) into apps such as Life360, GasBuddy, Fuel Rewards, and Routely.

Those four apps have been downloaded over 115 million times from Google Play alone.

The apps allegedly covertly collected sensitive location data every 15 seconds if users gave them location permission upon installation/launch.

Additionally, the lawsuit alleges that Allstate also purchased location data directly from Toyota, Lexus, Mazda, Chrysler, Dodge, Fiat, Jeep, Maserati, and Ram, to use for the same purposes.

The legal action claims violations of the TDPSA, the Data Broker Law, and the Texas Insurance Code concerning unfair and deceptive acts and practices.

The lawsuit requests several remedies, including:

• Civil penalties under the mentioned Texas laws, including penalties of up to $7,500 per violation under the TDPSA and $10,000 under the Texas Insurance Code.
• Restitution for consumers who suffered losses due to the alleged practices.
• Destruction of all unlawfully obtained data, including data held by third parties.
• Injunctive relief, preventing the defendants from continuing the described practices.

BleepingComputer has contacted both Allstate and Arity for a statement regarding Paxton's legal action, and a company spokesperson responded with the following comment: 

"Arity helps consumers get the most accurate auto insurance price after they consent in a simple and transparent way that fully complies with all laws and regulations."