Allstate and Arity's alleged unauthorized driver data collection through mobile apps

Introduction

Arity, established in 2016 as a subsidiary of Allstate Corporation, positions itself as a leader in mobility data analytics. According to their mission statement:

...collect{s} and analyze{s} trillions of miles of driving data to create a greater understanding of how people move. With the world's largest driving dataset tied to insurance claims collected through mobile devices, in-car devices, and vehicles themselves

screenshot of arity.com demonstrating their claim of having 40 million active mobile connections

According to their website, Arity maintains over 40 million active mobile connections, capturing data at intervals of 15 seconds or less. The Texas Attorney General's office has initiated legal proceedings against Allstate Corporation and its subsidiaries, including Arity, asserting that this data collection occurred without proper driver consent.

The State of Texas, under the direction of Attorney General Ken Paxton, has filed a lawsuit naming Allstate, Arity, and their subsidiaries as defendants, alleging multiple violations of data privacy regulations.

Claims made by the suit

Laws broken

The legal action alleges violations of multiple state regulations, including the Texas Data Privacy and Security Act, the Data Broker Law, and the Texas Insurance Code. The scope of the alleged data collection, implemented through mobile app software integration, extends beyond Texas residents to affect millions of Americans nationwide.

Claims made

Several assertions in this lawsuit require additional substantiation, as the source documentation provides insufficient information to verify their origins. For more information on this topic, please refer to anonymity and vagueness in citations.

Claims with evidence

What data Arity collects

According to the lawsuit and confirmed by Arity's privacy policy, the company collects:

• Geolocation data
• Accelerometer data
• Magnetometer data
• Gyroscopic data
• Trip attributes:
  • Start/end locations
  • Distances
  • Durations
  • Times of these movements
• GPS points
• Derived events:
  • Acceleration
  • Speeding
  • Distracted driving
  • Crashes

Arity's claims regarding their massive data collection

This is technically true

Arity's website makes the following verifiable claims:

1. Possession of the largest driving data collection
2. Data collection intervals of 15 seconds
3. Access to trillions of miles of driving data

Evidence of data collection vs. evidence of improper data collection

The lawsuit's citations primarily reference Arity's public statements, which alone do not establish wrongdoing. For comparison, Geico's smartphone application implements driver-monitoring data collection with explicit user consent, offering potential insurance rate reductions. Such data collection raises privacy concerns.

The lawsuit's core allegations focus on the undisclosed collection and monetization of insured drivers' behavioral data without proper consent, though concrete evidence supporting these claims remains pending.

Arity's lack of easy opt-out

Important: Consumers utilizing applications with integrated Arity SDK encountered systematic barriers to opting out of data collection.

The company's privacy policy provides inadequate guidance regarding data collection opt-out procedures. Their website redirects users to external resources, such as the Apple support center, which offer limited practical assistance in restricting Arity's data collection capabilities.

Defendants worked to Integrate the Arity SDK into mobile apps

The Texas Attorney General's lawsuit asserts that Arity and Allstate established financial arrangements with applications including Routely, Life360, GasBuddy, and Fuel Rewards to incorporate their SDK. While direct evidence of these arrangements is not presented in the legal documentation, the following economic factors support this business model:

1. The substantial market value of driving behavior data
2. Financial incentives for app developers to participate in data monetization
3. Arity's strategic interest in expanding their driver data collection network

Arity actively markets their SDK integration services to businesses and developers. Documentation of Arity's app integration exists through:

1. Public confirmation of the GasBuddy partnership through Arity's press releases
2. Detailed case study documentation of Life360's implementation of Arity's technology

Arity's claims about usage of data

The lawsuit references Arity's terms of service regarding data utilization, specifically citing their privacy policy:

Arity shares your information with its business clients as part of your purchase, or use, of services from those business clients. Those business clients include, but are not limited to, insurance companies as well as mobile app providers who track the location of members of a defined group or who provide weather related information. If you have purchased an insurance product offered by an Arity business client, then your information may also be used by that business client to calculate insurance rates or rewards provided under the product or service. Our insurance company business clients may also use your information to update their pricing and underwriting models. All such use of your personal information by our business clients is subject to their privacy policies and not this Privacy Statement.

Drivers not knowingly consenting to these terms

The terms of service present significant consent issues:

"Arity shares your information with its business clients as part of your purchase, or use, of services from those business clients."

This arrangement presents substantial privacy concerns, illustrated through the following scenario:

1. A user (James) engages with an Arity business client's application
2. James lacks awareness of Arity's existence
3. The business client omits disclosure of Arity's data handling practices
4. This creates an inherent impossibility of informed consent to Arity's privacy policy

"If you have purchased an insurance product offered by an Arity business client, then your information may also be used by that business client to calculate insurance rates or rewards provided under the product or service."

Important: The distinction between insurance and non-insurance business clients creates a critical privacy concern: Non-insurance entities may collect data that influences insurance rates without user awareness or consent.

Claims without evidence

The following allegations rely on the legal principle of information and belief, indicating that supporting evidence is anticipated through the discovery process rather than currently available.

Arity purchased information from automakers to complement their own data

Facebook screenshot of insurance app

The smartphone-based data collection methodology presents inherent accuracy limitations. For example, recreational activities like roller coaster rides might erroneously register as dangerous driving behavior.

However, the lawsuit's assertion regarding automotive manufacturer data sales remains unsubstantiated.

To potentially account for the Arity SDK Data's limitations, Defendants sought to combine the SDK Data with data collected directly from vehicles. As a result, Defendants began purchasing consumers' driving-related data from car manufacturers, such as Toyota, Lexus, Mazda, Chrysler, Dodge, Fiat, Jeep, Maserati, and Ram. On information and belief, consumers did not consent, nor were otherwise aware that, Defendants purchased their driving-related data from these car manufacturers

Arity's bonus incentives to developers for bundling data collection into their apps

The lawsuit states:

"To encourage developers to adopt Defendants' software, Defendants paid app developers millions of dollars to integrate Defendants' software into their apps. Defendants further incentivized developer participation by creating generous bonus incentives for increasing the size of their dataset."

This claim lacks concrete evidence of these financial arrangements.

Automakers who sold data

The lawsuit names Toyota, Lexus, Mazda, Chrysler, Dodge, Fiat, Jeep, Maserati, and Ram as participants in data sales to Arity, without providing supporting evidence for these assertions.