Allstate Arity driver data theft

Introduction

Arity is a subsidiary of Allstate founded in 2016. They claim to

...collect{s} and analyze{s} trillions of miles of driving data to create a greater understanding of how people move. With the world’s largest driving dataset tied to insurance claims collected through mobile devices, in-car devices, and vehicles themselves

screenshot of arity.com demonstrating their claim of having 40 million active mobile connections

They clam to have 40m active mobile connections, with data captured every 15 seconds or less. The state of Texas Attorney General's office claims this occurred without the consent of the drivers and has filed a lawsuit against Allstate Corporation and its subsidiaries, including Arity which was founded by Allstate.

Claims made by the suit

Laws broken:

The lawsuit accuses them of of violating state laws such as the Texas Data Privacy and Security Act , the Data Broker Law , and the Texas Insurance Code

Claims made:

This lawsuit makes many claims, that sound true. However, upon closer inspection, there is not enough information in the source document to understand where these came from. It is important to be wary of media reports that source the lawsuit, as accusations from an authoritative source will often be interpreted by members of the public as a guilty verdict against unpopular companies.

Claims with evidence:

Arity's claims regarding data collection.

This is technically true:

The suit cites Arity's website, where they claim to:

1. Have the largest collection of driving data
2. Collect new data on individuals every 15 seconds
3. Have access to trillions of miles of driving data.

Without further evidence, this is misleading:

While this sounds horrific; this is simply a quotation from Arity's website, that in and of itself contains no damning evidence. For instance, while dystopian, Geico's smartphone application allows individuals to opt into driver-monitoring data collection offering a chance at decreased insurance rates, and is upfront about this before opting you in. While this may not be a practice one may feel comfortable with, the choice is presented to the customer. The mere mention that a company collects driving data is not an indictment that privacy violations have occurred.

The allegations hone in on the secretive collection & monetization of insured's private driving behavior data without proper disclosure or consent to the driver. Allstate & its subsidiaries reportedly harvested this data through software integrated into mobile apps, impacting millions of Americans; not just those who are Texas residents.

Defendants Paid to Integrate the Arity SDK into Mobile Apps

The claim is made that defendents such as the Routely, Life360, GasBuddy, and Fuel Rewards app. Several motives can be inferred from this:

1. There is a large market for driving data that businesses are willing to pay for.
2. App developers have an incentive to pay for data collection SDKs, if there is a market for collecting driving data.
3. Arity has an incentive to provide their SDK that collects driving data, if app developers are willing to pay for it.

Arity's website markets themselves to individuals & businesses that would want to utilize their driver data collection utilities within their applications, in a commercial tone.

1. Arity has claimed that GasBuddy partnered with Arity to collect personal data from drivers.
2. Arity has authored a case study regarding Life360's utilization of Arity's products.

Claims without evidence:

These claims are submitted without citations, or "on information and belief" - which is a way of saying that while the proof is not yet available, the attorney general expects to find it through the legal process of discovery.

Automakers who sold data

The automakers that defendants bought data from were Toyota, Lexus, Mazda, Chrysler, Dodge, Fiat, Jeep, Maserati, and Ram.