Texas attorney general Ken Paxton filed a lawsuit on Monday against Allstate Corporation, its mobile analytics subsidiary Arity and the American insurance giant, alleging that they conspired with app developers to collect telematics information on millions of drivers without their consent, in violation consumer protection laws. Allstate allegedly used the data to increase rates, deny coverage or drop coverage. Attorney General Paxton saidthat
“Our investigation revealed that Allstate and Arity paid mobile apps millions of dollars to install Allstate’s tracking software,” the data was used to justify rate increases, deny coverage, or drop coverage. “The personal data of millions of Americans was sold to insurance companies without their knowledge or consent in violation of the law. Texans deserve better and we will hold all these companies accountable.”
The complaint [PDF]states that Allstate paid app developers for the integration of the Arity Driving Engine SDK, a software library which, as explained in its documentation, collects:
- geolocation data from mobile phones, accelerometer data,
- magneticometer data, gyroscopic information,
- travel attributes (start time and end time; distance; GPS points; accuracy, position, latitude and longitude; heading, speed; GPS; speed; GPS; GPS; GPS; GPS; GPS; [1945][1945][1945][1945][1945][1945];
These apps – which have been named in previous privacy suits regarding the sale of location data – first ask users for permission to access location data. The complaint states that the app requests permission to access location data in conjunction with its features.
Since the Artity SDK alone could not reliably identifiy drivers, Allstate allegedly licensed the personal data that was available to the apps, including first and last names, phone numbers, addresses, zip codes, mobile ad ID (MAID), device identification, and ad ID, and combined the data sets in order to profile drivers.
But the data was misapplied, according to Allstate. Allstate, for example, could not be sure that the individuals being monitored through these mobile applications were driving a vehicle. Look for the label: White House rolls out ‘Cyber Trust Mark’ for smart devices
“For example, if a person was a passenger in a bus, a taxi, or in a friend’s car, and that vehicle’s driver sped, hard braked, or made a sharp turn, Defendants would conclude that the passenger, not the actual driver, engaged in ‘bad’ driving behavior based on the Arity SDK Data,” explains the complaint. “Defendants would then subsequently sell and share the data so it could be used to inform decisions about that passenger’s insurability based on their ‘bad’ driving behavior.”
A man posted to the Roller Coaster Enthusiasts Club Facebook groupin October last year. “My insurance company mistakenly believed I was driving my car when, in reality, I was riding the roller coaster The Beast at Kings Island. Those red dots indicate where the app incorrectly assessed my cornering and braking skills and lowered my driving score.”
Allstate is accused of buying information about drivers from car companies, such as Toyota Lexus, Mazda and Chrysler, Dodge Fiat, Jeep Maserati and Ram, without their consent. Paxton filed a suit against General Motors in August, claiming thatthe car company had illegally collected data about drivers and sold that information to insurance firms.
The Allstate/Arity complaint goes on to allege that the privacy notices presented to app users failed to disclose the extent of data collection and sharing and inaccurately stated that Allstate and Arity “do not sell personal information for monetary value.”
The companies are charged with violations of the Texas Data Privacy and Security Act, Data Broker Law, and unfair competition/deceptive behavior under the state insurance code.
A spokesperson for Allstate told The Register, “Arity helps consumers get the most accurate auto insurance price after they consent in a simple and transparent way that fully complies with all laws and regulations.” (r)
