Texas Lawsuit Alleges Allstate Illegally Collects Driver Data
The State of Texas on Monday filed a lawsuit against Allstate, alleging the insurance company illegally collects driver data through secretly embedded software in mobile apps and then uses the data to justify raising Texans’ insurance rates.
Texas Attorney General Ken Paxton said Allstate and its subsidiary, Arity, have collected trillions of miles worth of location data from over 45 million customers nationwide to create the “world’s largest driving behavior database.” Texas alleges Allstate would use data to inform its underwriting as well as sell the driving behavior data to third parties, including other car insurance carriers.
Insurers used consumers’ data to justify increasing their car insurance premiums, denying them coverage, or dropping them from coverage, the complaint says.
“Arity helps consumers get the most accurate auto insurance price after they consent in a simple and transparent way that fully complies with all laws and regulations,” Allstate said in a statement.
Texas said Allstate violated the state’s Data Privacy and Security Act by never providing notice or obtaining Texans’ consent to collect or sell their sensitive data.
“Our investigation revealed that Allstate and Arity paid mobile apps millions of dollars to install Allstate’s tracking software,” Paxton said in a statement. “The personal data of millions of Americans was sold to insurance companies without their knowledge or consent in violation of the law. Texans deserve better and we will hold all these companies accountable.”
Texas alleges Allstate marketed and sold the data through third-party apps like Life360, GasBuddy, and Fuel Rewards as “driving” data reflecting customers’ driving habits.
Allstate recently began purchasing data about vehicles’ operation directly from car manufactures including Toyota, Lexus, Mazda, Chrysler, Dodge, Fiat, Jeep, Maserati, and Ram, the complaint says. Texas alleges Allstate did this to better account for their inability to distinguish whether a person was actually driving based on the location and movements of their phone,
The information pulled from customers’ phones includes geolocation data, accelerometer data, magnetometer data, and gyroscopic data, which monitors details such as the phone’s altitude, longitude, latitude, bearing, GPS time, speed, and accuracy.
Cobun Zweifel-Keegan, managing director of the International Association of Privacy Professionals, said the lawsuit is the beginning of what could be the first litigated court case under a comprehensive state privacy law.
“The allegations show how rules and expectations about consent are being modernized under consumer privacy laws,” said Zweifel-Keegan. State laws have stringent expectations about sensitive data like geolocation. It also highlights how privacy laws fit together with general consumer protection laws. In effect, each makes the other stronger. New privacy laws help to clarify what might count as an unfair practice when it comes to things like consent for collecting and selling data.”
Texas filed a lawsuit against General Motors last year accusing the carmaker of collecting drivers’ data and then selling it to insurers without consumers’ consent.
The story has been updated with a statement from Allstate.