Texas AG Sues Allstate Over Alleged Unlawful Data Harvesting

Texas Attorney General Ken Paxton has filed a landmark lawsuit against Allstate Corporation and its data subsidiary, Arity, for allegedly violating the Texas Data Privacy and Security Act (TDPSA). The lawsuit accuses the companies of collecting and selling sensitive driving data from over 45 million Americans, including millions of Texans, without their consent. Paxton asserts that this data was used by insurers, including Allstate, to adjust car insurance premiums unfairly.

Allstate tracking drivers around

The Allstate Corporation, headquartered in Illinois, is one of the largest personal insurance providers in the United States. Arity, founded in 2016, specializes in mobility data analytics and markets products like ArityIQ and Routely, which monetize driving behavior insights.

The lawsuit, filed in Montgomery County, Texas, claims that Allstate and Arity embedded tracking software into third-party mobile apps, such as Life360, to secretly harvest data from users' mobile devices. The collected information included precise geolocation data, speed, and driving patterns. Arity reportedly amassed “trillions of miles” worth of driving data, creating what it called “the world's largest driving behavior database.” This database was used for two purposes, namely, pricing Allstate's car insurance products, and selling data to other insurers who allegedly used it to increase premiums, deny coverage, or drop policyholders.

Allstate and Arity allegedly paid app developers millions to incorporate their software development kit (SDK) into their applications. Users who granted location-sharing permissions to these apps inadvertently allowed Allstate and Arity to harvest additional driving data without explicit consent or notification.

Collected data included:

• Geolocation (latitude, longitude, speed).
• Driving events such as acceleration and hard braking.
• Metadata like device type and operating system.

The lawsuit also accuses the companies of misleading consumers about their data collection practices and failing to disclose how the data would be used or monetized.

Legal and ethical implications

The case marks the first enforcement action under the TDPSA, which went into effect on July 1, 2024, to strengthen Texans' data privacy rights. The lawsuit also alleges violations of the Texas Insurance Code and the state's Data Broker Law, including processing sensitive data without obtaining clear, affirmative consent from consumers, failing to provide accessible and accurate privacy notices, and selling sensitive data without required disclosures.

The Texas lawsuit builds on Paxton's ongoing investigations into data practices by car manufacturers and tech companies. In a statement, Paxton said, “Texans deserve better, and we will hold these companies accountable for their disregard for privacy laws.”

The Attorney General is seeking civil penalties of up to $7,500 per violation under the TDPSA and additional penalties under the Data Broker Law and Insurance Code. Moreover, the lawsuit seeks injunctive relief to stop Allstate and Arity from collecting or using data unlawfully, restitution for affected consumers, and deletion of unlawfully obtained data.