Allstate Arity driver data theft

Introduction

Arity is a subsidiary of Allstate founded in 2016. They claim to

...collect{s} and analyze{s} trillions of miles of driving data to create a greater understanding of how people move. With the world’s largest driving dataset tied to insurance claims collected through mobile devices, in-car devices, and vehicles themselves

screenshot of arity.com demonstrating their claim of having 40 million active mobile connections

They clam to have 40m active mobile connections, with data captured every 15 seconds or less. The state of Texas Attorney General's office claims this occurred without the consent of the drivers and has filed a lawsuit against Allstate Corporation and its subsidiaries, including Arity which was founded by Allstate.

Claims made by the suit

Laws broken:

The lawsuit accuses them of of violating state laws such as the Texas Data Privacy and Security Act , the Data Broker Law , and the Texas Insurance Code. Allstate & its subsidiaries reportedly harvested this data through software integrated into mobile apps, impacting millions of Americans; not just those who are Texas residents.

Claims made:

This lawsuit makes many claims, that sound true. However, upon closer inspection, there is not enough information in the source document to understand where these came from. It is important to be wary of media reports that source the lawsuit, as accusations from an authoritative source will often be interpreted by members of the public as a guilty verdict against unpopular companies.

Claims with evidence:

What data Arity collects

Arity collects the following data per the lawsuit, that can be confirmed via their privacy policy:

• Geolocation data
• Accelerometer data
• magnetometer data
• Gyroscopic data
• Trip attributes:
  • start/end locations
  • distances
  • durations
  • times of these movements.
• GPS points
• Derived events
  • acceleration
  • speeding
  • distracted driving
  • crashes

Arity's claims regarding their massive data collection.

This is technically true:

The suit cites Arity's website, where they claim to:

1. Have the largest collection of driving data
2. Collect new data on individuals every 15 seconds
3. Have access to trillions of miles of driving data.

Without further evidence, this is misleading:

While this sounds horrific; this is simply a quotation from Arity's website, that in and of itself contains no damning evidence. For instance, while dystopian, Geico's smartphone application allows individuals to opt into driver-monitoring data collection offering a chance at decreased insurance rates, and is upfront about this before opting you in. While this may not be a practice one may feel comfortable with, the choice is presented to the customer. The mere mention that a company collects driving data is not an indictment that privacy violations have occurred.

The allegations hone in on the secretive collection & monetization of insured's private driving behavior data without proper disclosure or consent to the driver.

Arity's lack of easy opt-out

Even if a consumer of an application utilizing the Arity SDK wanted to opt out, there was no way for them to do so. Their privacy policy makes no meaningful mention of how to opt-out of data collection. Their website only occasionally links to outside websites that will be of little help to someone looking to limit Arity's data collection, such as the Apple support center.

Defendants worked to Integrate the Arity SDK into Mobile Apps

The claim is made that Arity & Allstate paid partnered apps such as Routely, Life360, GasBuddy, and Fuel Rewards to integrate their SDK into the apps. The proof for this is not within the suit, however, it an be inferred based on economic motives:

1. There is a large market for driving data that businesses are willing to pay for.
2. App developers have an incentive to receive money from other businesses.
3. Arity has an incentive to provide their SDK that collects driving data, given the market for driver data.

Arity's website markets themselves to individuals & businesses that would want to utilize their driver data collection utilities within their applications, in a commercial tone. That Arity was integrated into these mobile apps can be confirmed by case studies and PR statements made by Arity:

1. Arity has claimed that GasBuddy partnered with Arity to collect personal data from drivers.
2. Arity has authored a case study regarding Life360's utilization of Arity's products.

Arity's claims about usage of data

The lawsuit claims that Arity's terms of service provides information on how your data will be used, which is taken below from Arity's privacy policy:

Arity shares your information with its business clients as part of your purchase, or use, of services from those business clients. Those business clients include, but are not limited to, insurance companies as well as mobile app providers who track the location of members of a defined group or who provide weather related information. If you have purchased an insurance product offered by an Arity business client, then your information may also be used by that business client to calculate insurance rates or rewards provided under the product or service. Our insurance company business clients may also use your information to update their pricing and underwriting models. All such use of your personal information by our business clients is subject to their privacy policies and not this Privacy Statement.

Drivers not knowingly consenting to these terms

Arity's terms of service make the following claims, which customers have not consented to.

"Arity shares your information with its business clients as part of your purchase, or use, of services from those business clients."

Follow my logic.

1. I am using an application developed by an Arity business client.
2. I do not know who Arity is.
3. The business client has not told me how Arity uses my data.
4. Therefore, how can I have consented to Arity's privacy policy?

"If you have purchased an insurance product offered by an Arity business client, then your information may also be used by that business client to calculate insurance rates or rewards provided under the product or service."

Arity's business clients are not always insurance companies. This means that Arity is claiming that your insurance rates might be raised due to data collected by someone who is not your insurance company.

If the application I am using does not disclose that the information they are collecting on me may raise my insurance rates, that means I am being affected by terms of a privacy policy I was never made aware of.

This can be referred to as a game of telephone privacy policy.

Claims without evidence:

These claims are submitted without citations, or "on information and belief" - which is a way of saying that while the proof is not yet available, the attorney general expects to find it through the legal process of discovery.

Arity purchased information from automakers to compliment their own data

Facebook screenshot of insurance app

Arity's information collection was based on smartphone applications. Regardless of how accurate smartphone data collection is, this is an inaccurate way to judge the driving skills of an individual. For instance, if I am on a rollercoaster, I am not driving; but I may be judged as a poor driver for sudden turns and acceleration. However, no evidence is provided for sales of data from automakers to Arity.

To potentially account for the Arity SDK Data’s limitations, Defendants sought to combine the SDK Data with data collected directly from vehicles. As a result, Defendants began purchasing consumers’ driving-related data from car manufacturers, such as Toyota, Lexus, Mazda, Chrysler, Dodge, Fiat, Jeep, Maserati, and Ram. On information and belief, consumers did not consent, nor were otherwise aware that, Defendants purchased their driving-related data from these car manufacturers

Arity's bonus incentives to developers for bundling data collection into their apps

The suit claims

"To encourage developers to adopt Defendants’ software, Defendants paid app developers millions of dollars to integrate Defendants’ software into their apps. Defendants further incentivized developer participation by creating generous bonus incentives for increasing the size of their dataset."

However, no citations or evidence are provided.

The economic incentives for this behavior are clear: if driver data is in high demand, Arity could easily be selling driver data for way more money than the incentives offered to app developers to implement their data-collection-SDK. However, there is no evidence presented in the suit.

Automakers who sold data

The automakers that defendants bought data from were Toyota, Lexus, Mazda, Chrysler, Dodge, Fiat, Jeep, Maserati, and Ram.