Texas’ attorney general is suing the insurance giant Allstate and its subsidiary Arity for allegedly illegally collecting, using and selling cell phone location and movement data belonging to more than 45 million Americans without their knowledge.

Allstate harvested trillions of miles of that data from Americans’ cellphones through “secretly embedded” software Arity paid millions of dollars to place in mobile apps that tracked  consumers’ driving data, state Attorney General Ken Paxton announced Monday.  

By failing to give consumers notice or get their consent for gathering and selling the sensitive data, Allstate violated Texas’ new Data Privacy and Security Act, a press release from Paxton said.

The lawsuit is the first enforcement action any state attorney general has ever filed to prosecute alleged violations of a state-level comprehensive data privacy law, according to the press release. 

The Texas law took effect July 1. Twelve states have such laws, but the only publicly known enforcement activity underway is limited to Texas and California.

After receiving the data from the mobile apps, Arity shared it with Allstate and sold access to it to other unnamed insurers, all of whom used it to raise individual consumers’ premiums and give inflated price quotes to prospective new customers, according to the press release and the complaint. It is unclear if Allstate paid Arity for access since it is the data broker’s parent company.

The movement data Arity allegedly collected captures how fast a consumer’s mobile phone is traveling, according to a notice of violation Paxton sent Arity in November. Arity also sold insurers data, gleaned from the software embedded in the mobile apps, which showed “whether a consumer picked up or opened their phone while traveling at certain speeds,” according to the complaint.

Arity, a data broker, allegedly collected the location and movement data directly from consumers’ phones via the mobile apps it paid to embed its software in. The participating apps separately sent personally identifiable information belonging to app users to Arity so that the data sets could be combined, according to the complaint.

“Our investigation revealed that Allstate and Arity paid mobile apps millions of dollars to install Allstate’s tracking software,” Paxton said in a statement. “Millions of Americans were sold out to insurance companies without their knowledge or consent in violation of the law.”

Recorded Future News has contacted Arity and Allstate for comment.

Some 30.5 million people live in Texas, so Paxton’s office can safely assume that at least some of the 45 million Americans ensnared in Allstate’s alleged scheme are protected by the state’s privacy law.

The case illustrates how consumers' data privacy can be violated in ways they would never imagine when they sign up for mobile apps which share their data with third parties. Disclosures about third-party data sharing often omit specific details about who data is shared with — typically referring only to unnamed business partners — and are buried in dense privacy policies which most consumers don’t read. 

Automakers also allegedly sold drivers’ data illegally to Arity and Allstate. Car manufacturers named in the complaint as having done so include Toyota, Lexus, Mazda, Chrysler, Dodge, Fiat, Jeep, Maserati and Ram. They are not listed as defendants. Recorded Future News has contacted the automakers for comment.

The world’s ‘largest driving behavior database’

Arity used the data it purchased to construct a product that it bills as the “world’s largest driving behavior database,” Paxton alleges. The company charged insurers to access that database, according to the complaint.

“Improve pricing sophistication with access to actual driving behavior insights on tens of millions of drivers,” Arity’s website tells insurers, referring to its Arity IQ product. “Use Arity IQ to close the right quotes at the right price.”

Arity’s data has been a treasure trove for insurers. While the full list of insurance companies it supplied data to other than Allstate is not yet publicly known, press releases found online show that the CSAA Insurance Group and Google Cloud’s Analytics Hub insurance marketplace have partnered with Arity.

Arity also partners with Connected Analytic Services, LLC (CAS), a Toyota affiliate, to share driving data from connected cars with auto insurers, according to Arity’s website.

In June, the New York Times reported that CAS data is provided to Progressive.

Paxton warned Arity it was unlawfully collecting, sharing and selling sensitive consumer data without proper notice or consent in November.

The mobile apps

Last fall, Texas also warned six apps listed on Arity’s website as apparent partners that they were violating the state’s data privacy law. Those apps are: GasBuddy, Life360, Miles, MyRadar, SiriusXM and Tapestri. 

A seventh company sent a notice of violation in the fall — Excentus Corporation, which runs the Fuel Rewards program app — is not named on the Arity website or in press releases as an Arity partner, however, it is named in the complaint filed Monday against Arity.

Press releases or company website announcements documenting Arity partnerships with GasBuddy, Life360, MyRadar and Tapestri are available online..

The complaint names four mobile apps as participants in the alleged scheme. Texas has previously sent data privacy violation notices to three of those participants. They are Fuel Rewards, Life360 and GasBuddy. A fourth, Routely, has not yet been sent a notice of violation based on what is publicly known.

It is not clear if the other apps that received notices of violation in the fall participated in the Arity data harvesting program.

MyRadar discloses its relationship with Arity in its privacy policy. Its CEO Andy Green previously told Recorded Future News that the company only shares anonymized analytics data with “very explicit, clear consent presented to the user before we’re even able to collect anything remotely sensitive, and it’s always opt-in, not opt-out.”

The app’s privacy policy says it collects a vast array of location and driving data but asserts that the data it shares with Arity will not impact user insurance pricing.

The Fuel Rewards privacy policy does not mention selling sensitive data to Arity or Allstate. It does note that it “may sell your precise geolocation information in a manner that identifies you.”

Life360’s privacy policy says that it may disclose precise geolocation and movement data along with other information gleaned from technology embedded in users’ mobile devices. Data it shares with unspecified business partners includes information generated from mobile devices such as gyroscope, accelerometer, compass and Bluetooth; IP address; contact information; and driving event data.

It does not mention Arity or selling data to insurers.

GasBuddy’s privacy policy says it sells precise geolocation data to business partners but does not mention Arity or insurers.

Recorded Future News has contacted all but one of the mobile app companies for comment. A media contact for Routely could not be located.

Monday’s announcement follows on the heels of an August lawsuit Paxton filed against General Motors alleging false, deceptive and misleading business practices. That lawsuit accused the lawmaker of unlawfully collecting 1.8 million Texans’ driving data, which it then allegedly sold to insurers.

GM allegedly pressured drivers to sign up for features that collected their data. It then allegedly sold that data to other companies. Two of those companies used the data to create “driving scores” which were then sold to insurers, Paxton said at the time.

GM has said it is reviewing the complaint.

“We share the desire to protect consumers’ privacy,” a statement released when the lawsuit was announced said.