Texas’ attorney general has accused the data broker Arity, which sells individual drivers’ behavior data to insurers, of sharing consumers’ information without clear notice or consent.

The case is the latest Texas action highlighting how data protections can get murky when consumers use apps that track their behavior. In the past six weeks, six of the mobile apps that Arity says are partners have been accused by the state of improperly sharing user data with third parties.

Attorney General Ken Paxton has been quietly but aggressively enforcing the state’s new privacy law. Recorded Future News obtained the notice of violation against Arity through a public records request.

The notice of violation sent to Arity on Nov. 29 follows the October issuance of a civil investigative demand seeking all of the data broker’s agreements with mobile app providers. 

Arity did not respond to a request for comment.

The data broker, which is owned by the insurer Allstate, sells recommendations to insurers for how to price individual customers’ plans based on their driving behaviors. It gathers data through a software development kit (SDK) embedded inside the mobile apps belonging to its partners. 

“Improve pricing sophistication with access to actual driving behavior insights on tens of millions of drivers,” Arity’s website says, referring to its Arity IQ product. “Use Arity IQ to close the right quotes at the right price.”

It is not clear if Allstate uses Arity to price customers, and a spokesperson for the company did not respond to a request for comment.

While Arity’s entire roster of insurance clients is not publicly available, press releases reveal at least two. The CSAA Insurance Group and Google Cloud’s Analytics Hub insurance customers are working with Arity, according to the releases.

Arity and Connected Analytic Services, LLC (CAS), a Toyota affiliate, also work together by “bringing connected-car data from Toyota and Lexus vehicles to the Arity platform,” according to Arity’s website. “Through this partnership, Arity and CAS will provide driving data from connected vehicles to auto insurance carriers, enabling vehicle owners to access usage-based auto insurance (UBI) products.” 

The New York Times reported in June that Progressive receives data from CAS.

Arity’s website also says it owns the “largest driving behavior database” and has “collected over a trillion miles of driving data!”

The Texas notice of violation accuses Arity of failing to provide methods for consumers to opt out of their data being processed. 

It also says Arity failed to obtain consumers’ affirmative consent for collecting consumer data it processes through the SDK embedded in partners’ apps. 

Texas asserts that the SDK allows Arity to gather sensitive data including precise geolocation and “other information Arity derives from the location of a consumer’s mobile phone, including how fast a consumer’s mobile phone is moving.”

“This violation also includes Arity’s analysis and sale of sensitive data to car insurance companies,” it says, referring to the company’s alleged failure to obtain consent.

Data partnerships with apps

MyRadar, which allows users to track weather forecasts, received a notice of violation from Texas and is an example of an app that shares data with Arity.

MyRadar gives Arity driving event data, which the app’s privacy policy defines as including “speed, change in speed and other aspects of how, how much and where and when you drive.” 

Andy Green, MyRadar’s CEO, says the data shared is anonymized and that customers must opt in to the program.

“We do not share info with Arity that could identify a driver because we do not collect that information (unless you sign up for cross-platform subscription sharing, but regardless, we do not share this information with Arity),” Green said via email.  

“It is expressly forbidden with our agreement,” he added.  “We do not pass information to Arity that could be linked to an individual driver.”

None of the other mobile app companies Arity names as partners on its website and which Texas accused of violating its privacy law disclose their relationship with Arity in their privacy policies. They are GasBuddy, Life360, Sirius XM, Tapestri and Miles.

Other public statements from Arity and the apps do itemize the data it collects from the companies, however. 

While Arity’s press release announcing its partnership with GasBuddy did not explain how it shares data GasBuddy provides with third parties — which Texas says it does — it did offer a window into the breadth of the data it collects.

“GasBuddy has seamlessly embedded Arity's technology into their app, which enhances its user experience by leveraging telematics data,” the press release says. “Arity will look at driving behaviors, mileage, and other comparable data to create a fuel savings score for each driver.”

Another app Texas charged with violating its privacy law, Life360, says on its website that it works with Arity to “process driving data in real-time.”

A press release announcing an Arity partnership with Tapestri, an app that pays users for their data, says Arity uses the data to create a driving score.

“After taking several trips, Arity will present a personalized driving score based on personal driving habits, such as speeding, hard braking, and phone handling while driving,” the release says. 

Tapestri, GasBuddy and Life360 did not respond to requests for comment.