Texas Attorney General Ken Paxton has filed a lawsuit against Allstate Corporation and its subsidiary, Arity, for allegedly engaging in unlawful practices to collect, use, and sell sensitive driving and location data from over 45 million Americans, including millions of Texans.
“Our investigation revealed that Allstate and Arity paid mobile apps millions of dollars to install Allstate’s tracking software,” Paxton said in a statement. “The personal data of millions of Americans was sold to insurance companies without their knowledge or consent in violation of the law. Texans deserve better, and we will hold all these companies accountable.”
A spokesperson from Allstate told The Epoch Times in an emailed statement that the company and its subsidiary operate in compliance with the law.
“Arity helps consumers get the most accurate auto insurance price after they consent in a simple and transparent way that fully complies with all laws and regulations,” the spokesperson said.
The complaint alleges violations of the Texas Data Privacy and Security Act (TDPSA), the Data Broker Law, and the Texas Insurance Code’s prohibition on unfair and deceptive practices in the insurance business.
The TDPSA is a data privacy law that took effect in 2024 and mandates clear notice and informed consent when companies collect or sell sensitive personal data. It also provides heightened protections for precise geolocation data, which can pinpoint an individual’s location to within a few feet. The lawsuit, which marks the first enforcement of the TDPSA by a state attorney general, alleges that Allstate and Arity failed to meet these requirements by neither informing consumers of their data practices nor obtaining explicit consent.
“Defendants covertly collected much of their ’trillions of miles’ of data by maintaining active connections with consumers’ mobile devices and harvesting the data directly from their phones,” the complaint reads. “Millions of Americans, including Texans, were never informed about, nor consented to, Defendants’ continuous collection and sale of their data.”
The state’s filing alleges that data collected through the embedded software was sold to other insurance companies and used for underwriting decisions.
“If a consumer requested a car insurance quote or had to renew their coverage, Insurers would access that consumer’s driving behavior in Defendants’ database. Insurers then used that consumer’s data to justify increasing their car insurance premiums, denying them coverage, or dropping them from coverage,” the complaint alleges.
The lawsuit also alleges that the tracking software sometimes misinterprets behaviors—for instance, categorizing a passenger’s activity as risky driving or even mistaking roller-coaster rides for poor driving habits.
“For example, if a person was a passenger in a bus, a taxi, or in a friend’s car, and that vehicle’s driver sped, hard braked, or made a sharp turn, Defendants would conclude that the passenger, not the actual driver, engaged in ‘bad’ driving behavior” based on the collected data, the complaint alleges.
The lawsuit seeks significant penalties under the TDPSA, including fines of up to $7,500 per violation and an order for Allstate and Arity to delete all improperly obtained data as alleged. It also demands restitution for affected consumers and measures to prevent future violations.
