Hack Reports - Latest Cybersecurity News, Trends & Updates

Allstate car insurer sued for tracking drivers without permission

Geetansh -

Allstate Tracking Lawsuit and Driver Data Privacy

On January 13, 2025, the State of Texas filed a lawsuit against Allstate, alleging the insurance company illegally collected and sold driver data without the consent of the individuals involved. Here are the key points from the recent news coverage:

Allegations Against Allstate

  • The lawsuit, filed by Texas Attorney General Ken Paxton, accuses Allstate and its subsidiary Arity of unlawfully collecting, using, and selling location and movement data from millions of Americans' cell phones. This data was obtained through secretly embedded software in various mobile apps, including Life36025.
  • Allstate allegedly paid app developers to incorporate this tracking software into their apps, allowing the company to monitor users' location and movement in real-time without their knowledge or consent25.

Scope of Data Collection

  • The data collected includes geolocation, accelerometer, magnetometer, and gyroscopic data, which provides detailed information about the phone’s altitude, longitude, latitude, bearing, GPS time, speed, and accuracy12.
  • The lawsuit claims that Allstate collected trillions of miles worth of location data from over 45 million people across the United States, creating what is described as the "world's largest driving behavior database"25.

Violation of Privacy Laws

  • The actions of Allstate and Arity are alleged to violate the Texas Data Privacy and Security Act (TDPSA), which requires clear notice and informed consent regarding the use of sensitive data such as geolocation information25.
  • Experts like Cobun Zweifel-Keegan from the International Association of Privacy Professionals highlight that this case represents a significant development in the enforcement of consumer privacy laws and the modernization of consent rules1.

Impact on Insurance Rates and Data Sales

  • The collected data was used by Allstate to justify raising insurance rates for millions of Texans. Additionally, the company sold this data to other insurance carriers, further exacerbating the privacy concerns25.

Previous Actions by Texas Attorney General

  • This is not the first time Texas Attorney General Ken Paxton has taken action against companies for violating data privacy laws. Last year, he sued General Motors for collecting and selling the private driving data of over 1.5 million Texans without their consent245.

Consumer Awareness and Cybersecurity Implications

  • The lawsuit underscores the importance of consumer awareness regarding data collection practices. Consumers are advised to be cautious when installing apps that request location data and to opt for permissions that limit continuous tracking24.
  • The case also highlights broader cybersecurity concerns, as companies collecting sensitive data do not always ensure its safekeeping. Recent breaches, such as the one at data broker Gravy Analytics, have led to the loss of millions of people’s sensitive location data5.
  • The lawsuit is expected to set a precedent for future cases involving data privacy and consumer protection. Experts predict that this will be a growing area of legal focus, with many more lawsuits anticipated on similar grounds4.

In summary, the Allstate lawsuit represents a significant challenge to the practices of insurance companies in collecting and using personal data without consent, and it underscores the evolving landscape of consumer privacy laws and cybersecurity regulations. Here are some relevant sources for further reading:

  • [Insurance Journal: Texas Lawsuit Alleges Allstate Illegally Collects Driver Data]1
  • [Tom's Guide: 45 million Americans allegedly had their location data collected and sold by Allstate]2
  • [Express News: Texas sues Allstate over collection, sale of consumers' ‘driving behavior’ data]3
  • [CBS Austin: Allstate sued for allegedly tracking Texans' driving habits without consent to use, sell]4
  • [Malwarebytes: Insurance company accused of using secret software to illegally collect and sell location data on millions of Americans]5