Texas has sued Allstate and its subsidiary Arity, accusing them of illegally collecting and selling the personal data of over 45 million Americans without consent. If true, this would be a violation of state privacy laws.
The state of Texas has filed a lawsuit against Allstate and its subsidiary, Arity. The lawsuit accuses the companies of illegally collecting, using, and selling sensitive cell phone location and movement data from over 45 million Americans without their consent. Texas Attorney General Ken Paxton announced the lawsuit on Monday, alleging that Allstate violated the state’s recently enacted Data Privacy and Security Act.
According to the complaint, Allstate used software embedded in mobile apps, developed by Arity, to secretly gather and monetize sensitive consumer data. The lawsuit also claims violations of the Texas Data Broker Law and the Texas Insurance Code’s ban on deceptive practices.
The case represents the first enforcement action under a state-level comprehensive data privacy law, demonstrating Texas’ commitment to addressing privacy violations since its law took effect on July 1.
The lawsuit alleges Arity has been licensing its tracking software to app developers since at least 2017. Once downloaded, the software captures various data, including geolocation, accelerometer, gyroscopic data, and more. It allegedly tracks consumer movements in real-time, including driving behaviors such as speeding, distracted driving, and crash detection.
Arity also allegedly combines data from mobile apps with personally identifiable information provided by the apps, such as advertising IDs, to create detailed profiles that can match driving behaviors to specific individuals. The data is then allegedly sold to insurers to adjust premiums and provide quotes, with no consumer knowledge or consent.
The lawsuit further claims that mobile apps using Arity’s software did not disclose the data collection practices, and users were not given the option to opt-out. Some of the apps named include Fuel Rewards, Life360, GasBuddy, and Arity's own telematics app, Routely.
Paxton’s complaint also names automakers, such as Toyota, Mazda, and Fiat, as suppliers of driving data to Arity and Allstate. These manufacturers are not listed as defendants but are implicated in facilitating the data collection.
“Our investigation revealed that Allstate and Arity paid mobile apps millions of dollars to install Allstate’s tracking software,” Paxton said in a statement. “Millions of Americans were sold out to insurance companies without their knowledge or consent in violation of the law.”
The complaint discusses deceptive language in Arity’s privacy disclosures, such as claims that it does not “sell personal information for monetary value,” while its business practices suggest otherwise. Arity’s website promotes its data products as tools for insurers to more accurately price premiums based on driving behavior.
The case reflects growing concerns about collecting, sharing, and monetizing personal data without clear consumer consent. Texas’ lawsuit against Allstate and Arity could set a precedent for enforcing privacy laws at the state level and challenge companies that use personal data for profit. If successful, the lawsuit could result in stricter requirements for data collection and usage and significant financial penalties for companies that violate privacy laws.
The Texas Data Privacy and Security Act, which took effect on July 1, tries to protect consumer data by regulating how businesses collect, use, and share personal information.
Arity’s software tracks users’ geolocation, driving behaviors, and other data from mobile apps, which are then sold to insurers for premium pricing without consumer consent.
If the lawsuit succeeds, Allstate could face fines, stricter data privacy regulations, and potential changes in how it collects and uses consumer data.