Insurers used consumers’ data to justify increasing their car insurance premiums, denying them coverage, or dropping them from coverage, the complaint says.
Texas said Allstate violated the state’s Data Privacy and Security Act by never providing notice or obtaining Texans’ consent to collect or sell their sensitive data.
“Our investigation revealed that Allstate and Arity paid mobile apps millions of dollars to install Allstate’s tracking software,” Paxton said in a statement. “The personal data of millions of Americans was sold to insurance companies without their knowledge or consent in violation of the law. Texans deserve better and we will hold all these companies accountable.”
Texas alleges Allstate marketed and sold the data through third-party apps like Life360, GasBuddy, and Fuel Rewards as “driving” data reflecting customers’ driving habits.
Allstate recently began purchasing data about vehicles’ operation directly from car manufactures including Toyota, Lexus, Mazda, Chrysler, Dodge, Fiat, Jeep, Maserati, and Ram, the complaint says. Texas alleges Allstate did this to better account for their inability to distinguish whether a person was actually driving based on the location and movements of their phone,
The information pulled from customers’ phones includes geolocation data, accelerometer data, magnetometer data, and gyroscopic data, which monitors details such as the phone’s altitude, longitude, latitude, bearing, GPS time, speed, and accuracy.
Cobun Zweifel-Keegan, managing director of the International Association of Privacy Professionals, said the lawsuit is the beginning of what could be the first litigated court case under a comprehensive state privacy law.
“The allegations show how rules and expectations about consent are being modernized under consumer privacy laws,” said Zweifel-Keegan. State laws have stringent expectations about sensitive data like geolocation. It also highlights how privacy laws fit together with general consumer protection laws. In effect, each makes the other stronger. New privacy laws help to clarify what might count as an unfair practice when it comes to things like consent for collecting and selling data.”
Texas filed a lawsuit against General Motors last year accusing the carmaker of collecting drivers’ data and then selling it to insurers without consumers’ consent.
