Allstate and Arity's alleged unauthorized driver data collection through mobile apps

Introduction

Arity is a subsidiary of Allstate founded in 2016. They claim to

...collect{s} and analyze{s} trillions of miles of driving data to create a greater understanding of how people move. With the world’s largest driving dataset tied to insurance claims collected through mobile devices, in-car devices, and vehicles themselves

screenshot of arity.com demonstrating their claim of having 40 million active mobile connections

They clam to have 40m active mobile connections, with data captured every 15 seconds or less. The state of Texas Attorney General's office claims this occurred without the consent of the drivers and has filed a lawsuit against Allstate Corporation and its subsidiaries, including Arity which was founded by Allstate.

Claims made by the suit

Laws broken:

The lawsuit accuses them of of violating state laws such as the Texas Data Privacy and Security Act , the Data Broker Law , and the Texas Insurance Code. Allstate & its subsidiaries reportedly harvested this data through software integrated into mobile apps, impacting millions of Americans; not just those who are Texas residents.

Claims made:

This lawsuit makes many claims, that sound true. However, upon closer inspection, there is not enough information in the source document to understand where these came from. It is important to be wary of media reports that source the lawsuit, as accusations from an authoritative source will often be interpreted by members of the public as a guilty verdict against unpopular companies.

Claims with evidence:

Arity's claims regarding their massive data collection.

This is technically true:

The suit cites Arity's website, where they claim to:

1. Have the largest collection of driving data
2. Collect new data on individuals every 15 seconds
3. Have access to trillions of miles of driving data.

Without further evidence, this is misleading:

While this sounds horrific; this is simply a quotation from Arity's website, that in and of itself contains no damning evidence. For instance, while dystopian, Geico's smartphone application allows individuals to opt into driver-monitoring data collection offering a chance at decreased insurance rates, and is upfront about this before opting you in. While this may not be a practice one may feel comfortable with, the choice is presented to the customer. The mere mention that a company collects driving data is not an indictment that privacy violations have occurred.

The allegations hone in on the secretive collection & monetization of insured's private driving behavior data without proper disclosure or consent to the driver.

Defendants Paid to Integrate the Arity SDK into Mobile Apps

The claim is made that Arity & Allstate paid partnered apps such as Routely, Life360, GasBuddy, and Fuel Rewards to integrate their SDK into the apps. The proof for this is not within the suit, however, it an be inferred based on economic motives:

1. There is a large market for driving data that businesses are willing to pay for.
2. App developers have an incentive to receive money from other businesses.
3. Arity has an incentive to provide their SDK that collects driving data, given the market for driver data.

Arity's website markets themselves to individuals & businesses that would want to utilize their driver data collection utilities within their applications, in a commercial tone. That Arity was integrated into these mobile apps can be confirmed by case studies and PR statements made by Arity:

1. Arity has claimed that GasBuddy partnered with Arity to collect personal data from drivers.
2. Arity has authored a case study regarding Life360's utilization of Arity's products.

Arity's claims about usage of data

The lawsuit claims that Arity's terms of service provides information on how your data will be used, which is taken below from Arity's privacy policy:

Arity shares your information with its business clients as part of your purchase, or use, of services from those business clients. Those business clients include, but are not limited to, insurance companies as well as mobile app providers who track the location of members of a defined group or who provide weather related information. If you have purchased an insurance product offered by an Arity business client, then your information may also be used by that business client to calculate insurance rates or rewards provided under the product or service. Our insurance company business clients may also use your information to update their pricing and underwriting models. All such use of your personal information by our business clients is subject to their privacy policies and not this Privacy Statement.

Drivers not knowingly consenting to these terms

Arity's terms of service make the following claims, which customers have not consented to.

"Arity shares your information with its business clients as part of your purchase, or use, of services from those business clients."

Follow my logic.

1. I am using an application developed by an Arity business client.
2. I do not know who Arity is.
3. The business client has not told me how Arity uses my data.
4. Therefore, how can I have consented to Arity's privacy policy?

"If you have purchased an insurance product offered by an Arity business client, then your information may also be used by that business client to calculate insurance rates or rewards provided under the product or service."

Arity's business clients are not always insurance companies. This means that Arity is claiming that your insurance rates might be raised due to data collected by someone who is not your insurance company.

If the application I am using does not disclose that the information they are collecting on me may raise my insurance rates, that means I am being affected by terms of a privacy policy I was never made aware of - a game of telephone privacy policy.

Claims without evidence:

These claims are submitted without citations, or "on information and belief" - which is a way of saying that while the proof is not yet available, the attorney general expects to find it through the legal process of discovery.

Arity's bonus incentives to developers for bundling data collection into their apps

The suit claims

"To encourage developers to adopt Defendants’ software, Defendants paid app developers millions of dollars to integrate Defendants’ software into their apps. Defendants further incentivized developer participation by creating generous bonus incentives for increasing the size of their dataset."

However, no citations or evidence are provided.

The economic incentives for this behavior are clear: if driver data is in high demand, Arity could easily be selling driver data for way more money than the incentives offered to app developers to implement their data-collection-SDK. However, there is no evidence presented in the suit.

Automakers who sold data

The automakers that defendants bought data from were Toyota, Lexus, Mazda, Chrysler, Dodge, Fiat, Jeep, Maserati, and Ram.