Texas Sues Allstate for Alleged Data Privacy Violations

Suzanne Smalley reports in The Record that the Texas Attorney General has filed a landmark lawsuit against Allstate and its subsidiary Arity for data privacy violations, including harvesting and selling the location and movement data of over 45 million Americans without consent.

The suit, State of Texas v. The Allstate Corp., et al., claims violations of Texas’s new Data Privacy and Security Act and other laws. This is the first time a state attorney general has enforced a state-level data privacy statute.

Arity, established in 2017, embeds its tracking software in mobile apps, collecting extensive consumer data such as geolocation, accelerometer readings, and gyroscopic measurements.

The data tracks users’ movements, including trip details, and is marketed as “driving behavior” data. However, the complaint alleges that the software merely tracks phone movements, potentially impacting insurance premiums based on the driving behavior of someone the user is riding with.

The data is sold to insurers, including Allstate, and shared with app developers, who are incentivized by bonuses. Automakers are also implicated in supplying driving data to Arity, though they are not named defendants.

The lawsuit accuses Allstate and Arity of data privacy violations, such as exploiting users’ data through deceptive practices and failing to provide adequate disclosure or consent mechanisms.

The complaint says that Arity aggregates sensitive data, matches it to individuals using app-collected identifiers, and sells it to insurers to adjust premiums and quotes. It argues that this breaches state laws, including requirements for data brokers to register and prohibitions against deceptive practices. It seeks monetary damages, restitution, and an order to delete improperly collected data.

It also exposes gaps in consumer knowledge about data-sharing practices, particularly among apps like GasBuddy, Life360, and Fuel Rewards, which fail to disclose partnerships with Arity adequately.

The case highlights the legal risks for companies handling consumer data. Although it is the first data privacy suit filed by a state AG, it is unlikely to be the last and reinforces the need for strategies to mitigate regulatory and reputational risks.