According to the lawsuit, the defendants covertly collected the data by developing software put into third-party apps that allowed Allstate to monitor an individual's live location and movement. (Credit: Rostislav Sedlacek/Adobe Stock)
Texas Attorney General Ken Paxton sued Allstate Insurance Co. for allegedly conspiring to collect and sell data from mobile devices, without the owners' consent. However, the insurer denies any wrongdoing.
Allstate and its subsidiary Arity LLC allegedly created a database to track driving behavior, and used the information to justify raising insurance rates, according to the suit filed Monday in Montgomery County, Texas.
“Our investigation revealed that Allstate and Arity paid mobile apps millions of dollars to install Allstate’s tracking software,” Paxton said. “The personal data of millions of Americans was sold to insurance companies without their knowledge or consent in violation of the law. Texans deserve better and we will hold all these companies accountable.”
According to the lawsuit, the defendants covertly collected the data by developing software put into third-party apps that allowed Allstate to monitor an individual's live location and movement.
For example, the app Life360, an app used predominately to track the location of friends and family members, is one of the apps allegedly utilized to watch consumers driving behavior.
In addition to allegedly selling the data to other insurance companies, the plaintiff also claimed the defendants have also purchased data from car manufacturers like Toyota, Lexus, Mazda, Chrysler, Dodge, Fiat, Jeep, Maserati and Ram. This information, collected from in-car devices, has allegedly been used for insurance underwriting.
But Allstate says otherwise.
“Arity helps consumers get the most accurate auto insurance price after they consent in a simple and transparent way that fully complies with all laws and regulations," Allstate said in a statement.
Paxton also sued General Motors in August 2024 for allegedly selling drivers' data to insurance companies. The state claims General Motors accumulated driving data recorded in newer vehicles.
The state of Texas claimed the defendants violated the Texas Data Privacy and Security Act, the Data Broker Law and Texas Insurance Code because consumers never consented to the collection and sale of their data.
"Even if a consumer took the extra step to investigate Defendants outside of their app, navigated to Defendants’ website, and located their privacy disclosures, they would still not understand what Defendants did with their data," the complaint said. "Consumers reading Defendants’ privacy disclosures are met with a series of untrue and contradictory statements that do not reflect Defendants’ practices."
The lawsuit is seeking to impose civil penalties on Allstate of up to $10,000 per violation of the Insurance Code and Data Broker Law and up to $7,500 per violation of the data privacy act.
Gregory L. Ewing of Dickinson Wright, a Washington D.C. cyber security and technology lawyer, said it's likely other insurance providers could face similar litigation if they have purchased data from Arity or are conducting similar alleged schemes.
"I think the insurance company set themselves up for trouble when they allegedly changed people's insurance rates because of this driving information," Ewing said. "I would not be surprised if we do see some class action lawsuits in that area. I am sure there's a class action firm out there that is drafting a complaint."
Russ Anderson of Pullman & Comley, Connecticut privacy and data security attorney, said other states with comprehensive privacy laws could file similar actions.
"There's plenty of states that have statutes that would forbid this conduct," Anderson said. "Frankly, given the fines that could be implemented, it's an easy thing for a lot of these states to essentially join these actions or create separate actions for the same conduct ... because the facts as alleged are pretty damning."
On the private front, Anderson said most privacy laws do not have a private right of action, so any class actions would likely utilize an unfair trade practice argument.
In response to the allegations, Anderson said the defendant might argue "Life360 or their partners received consent on their behalf, and that, although their privacy policies could have been more specific, that somewhere buried within the privacy policy they explained the conduct that was occurring."
Even so, "looking at the Texas complaint, it doesn't look great in terms of them being able to make those defenses," Anderson said.
Ewing said it is likely to settle.
"Generally speaking, no one wants to litigate," Ewing said. "That said, I think we'll see some interesting motion practices interpreting this Texas [data privacy] law and seeing if it actually implicates this type of information."
Anderson said Allstate could face tremendous penalties, but "I don't think Texas is out to bankrupt Allstate. What you're really looking at is some form of a settlement where they agree to pay some not insignificant amount of money, as well as agreeing to delete the data and essentially not do it again."
Twenty states have data privacy laws, and Anderson said more states seem open to passing similar legislation.
"The first states were the usual suspects that would be expected to have a lot of legislation, ... states that have more democratic leadership," Anderson said. "Texas is not that, so if Texas has the law and is going after Allstate like this, that would seem to indicate that this is not a partisan issue, and more states are likely to create these kinds of laws."
While there have been parties interested in a federal data privacy law, Anderson said talks are often held up on issues like a right of private action and the conflict with current data privacy laws in individual states.
In terms of a potential nonpartisan area, Ewing said "this is 45 million people whose data was collected without consent, if you believe the allegations. That's a true populist, let's fight that fight, and maybe that's a common ground between privacy advocates and populist Republicans that may actually be what makes this work."
© Arc, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to TMSalesOperations@arc-network.com. For more information visit Asset & Logo Licensing.