Allstate and its subsidiary Arity collected trillions of miles of driving behavior data from over 45 million Americans without their knowledge or explicit consent, then sold that data to third-party insurance companies and used it to make underwriting decisions and increase insurance premiums. The company embedded tracking software development kits (SDKs) into popular third-party mobile apps including Life360, Routely, GasBuddy, and Fuel Rewards, secretly monitoring driver location, speed, braking patterns, acceleration, and phone use. This systematic data harvesting without consent has sparked multiple class action lawsuits and enforcement actions from state attorneys general, with the Texas Attorney General filing the first-ever lawsuit under Texas’s comprehensive state privacy law on January 13, 2025. The scope of the alleged wrongdoing is staggering.
Arity didn’t just passively collect data that was being generated anyway—the company actively embedded surveillance technology into apps that consumers trusted for navigation, fuel discounts, and family location sharing. When a driver used GasBuddy to find the nearest gas station or Life360 to share their location with family members, they unknowingly gave Allstate access to their complete driving profile. This data wasn’t kept confidential; Allstate sold it to other insurance companies, creating a market for intimate knowledge of how 45 million Americans actually drive. A federal judge in Chicago allowed the proposed class action lawsuit to move forward in March 2026, dismissing some claims but permitting drivers to proceed with allegations of illegal cellphone data collection and unauthorized use of their personal information. Multiple active class actions are now pending against Allstate related to these allegations, along with separate claims about overcharged premiums based on data obtained through deceptive practices.
Table of Contents
- How Did Allstate Secretly Collect Driving Behavior Data Without Consent?
- What Data Was Actually Collected and How Was It Used?
- What Legal Actions Have Been Filed Against Allstate?
- How Should Consumers Identify Themselves as Potential Class Members?
- What Are the Common Issues and Limitations in This Case?
- How Did This Surveillance Escape Notice for So Long?
- What Does This Mean for Insurance Privacy and Future Regulation?
- Conclusion
How Did Allstate Secretly Collect Driving Behavior Data Without Consent?
Allstate’s subsidiary Arity developed a sophisticated surveillance infrastructure disguised as neutral software libraries. When app developers integrated Arity’s SDKs into popular applications, they unknowingly embedded data collection tools that tracked far more than necessary for the apps’ core functions. A driver using Fuel Rewards to get discounts on gasoline would have their precise location, speed, braking intensity, acceleration patterns, and mobile device behavior recorded continuously. The SDKs operated in the background with no visible notification that surveillance was occurring, and Allstate’s terms of service buried disclosures about this data collection in language so obscure that most consumers never discovered what was happening. The scope of data collection extended to behavior that has nothing to do with the apps’ primary purpose. Life360 is a family location-sharing app, so location tracking makes intuitive sense.
But Arity’s SDK in Life360 collected detailed information about how aggressively drivers braked, how quickly they accelerated, and whether they used their phones while driving—data that serves no purpose for a family safety app but proved highly valuable to insurance underwriters looking for risk factors. This pattern repeated across every app that integrated Arity’s technology: GasBuddy tracked fuel purchases and locations; Routely tracked driving routes and patterns. Each app unknowingly became a surveillance point feeding detailed behavioral profiles back to Allstate. One concrete example illustrates the invasiveness of this surveillance: Allstate could identify drivers who frequently accelerated hard (a risk factor), braked suddenly (a risk factor), or used their phones while driving (a major risk factor). Using this detailed profile, Allstate could then increase premiums for these customers even if they had no accidents or violations on their driving record. A driver who used GasBuddy to find cheaper fuel might later find their insurance rates jumped based on driving behavior that Allstate observed while they searched for gas stations.
What Data Was Actually Collected and How Was It Used?
The scale of data collection was enormous: trillions of miles of location and movement data, spanning years of observation across multiple apps. This wasn’t a minor breach or isolated incident. allstate systematically harvested data from tens of millions of drivers on a continuous basis, creating detailed behavioral profiles more comprehensive than what most insurance companies obtained through voluntary participation in usage-based insurance programs. Arity aggregated this data, processed it to identify risk patterns, and then sold it to other insurance companies and used it for Allstate’s own underwriting decisions. The end use of this data made the violation particularly egregious. Allstate didn’t collect this information to improve safety or provide free navigation services to consumers. The company collected it for a single purpose: to identify drivers deemed higher risk and charge them higher insurance premiums.
If Allstate’s analysis showed that a driver frequently drove at night, accelerated quickly, or lived in certain geographic areas, those factors could trigger rate increases. The driver would have no idea that rates increased based on secret data collection, no opportunity to correct inaccurate information, and no option to opt out of the surveillance before it influenced their insurance costs. A critical limitation of relying on this type of behavioral data is accuracy. Driving behavior analysis can misidentify risk through correlation without causation. A driver who accelerates quickly might do so because they’re merging onto highways during rush hour traffic, not because they’re a reckless driver. Someone who brakes suddenly might be avoiding a pothole or responding to unexpected traffic, not demonstrating poor driving skills. Allstate used this imperfect behavioral analysis to make underwriting decisions without giving drivers the opportunity to know about or challenge the data being used against them. This raises serious questions about the fairness and accuracy of rates determined partly through data collected without knowledge or consent.
What Legal Actions Have Been Filed Against Allstate?
The Texas Attorney General, under the leadership of Ken Paxton, filed the first-ever lawsuit against a company under Texas’s comprehensive state privacy law on January 13, 2025, targeting Allstate and Arity for unlawfully collecting, using, and selling over 45 million consumers’ personal information. This lawsuit represents a landmark enforcement action because it’s the first prosecution under a new privacy framework, signaling that state attorneys general are beginning to enforce consumer privacy rights in meaningful ways. The Texas lawsuit alleged violations of the Texas Data Privacy and Security Act, which provides specific remedies and penalties for companies that violate consumer privacy without proper consent. In federal court, a judge in Chicago allowed a class action lawsuit to advance on March 19, 2026, which is a significant victory for drivers attempting to hold Allstate accountable. The court dismissed some claims in the case but preserved the core allegations: that Allstate collected cellphone data without authorization and used it for insurance underwriting purposes.
The fact that a federal judge found these allegations serious enough to survive an initial motion to dismiss suggests the case has legal merit and a reasonable likelihood of surviving to settlement or trial. Multiple active class actions are now pending in various jurisdictions, all arising from Allstate’s data collection practices. One comparison that illustrates the severity of these actions: in 2019, Equifax paid $700 million to settle a data breach lawsuit affecting 147 million Americans. The Allstate case potentially affects even more people and involves intentional wrongdoing rather than a breach of negligently protected systems. This suggests the potential damages in the Allstate litigation could be substantial if the company is found liable. Consumers affected by the Arity data collection have a legitimate basis for filing claims in any class action settlement that emerges from these lawsuits.
How Should Consumers Identify Themselves as Potential Class Members?
Most consumers won’t realize they were subject to Allstate’s secret surveillance unless they received specific notifications or read news coverage about the lawsuits. If you were an Allstate insurance customer at any point during the period when Arity was collecting data through Life360, Routely, GasBuddy, or Fuel Rewards, you are potentially a member of the affected class. You don’t need to have been an active user of Arity’s SDKs to potentially qualify; simply having those apps installed during the data collection period could be sufficient. If you ever owned a car and carried a smartphone, there’s a meaningful chance you were caught in Allstate’s data collection net. The practical challenge for consumers is keeping track of which lawsuits are active and how to file claims. Multiple class actions are moving through the court system simultaneously, and each may have different claim filing deadlines, eligibility requirements, and potential payment amounts.
Some consumers may be eligible for multiple class actions, while others might qualify for only one. Establishing proof of membership—typically by showing you were an Allstate customer, or that you had certain apps installed on your device during the relevant time period—will be essential. Courts will eventually certify classes defining exactly who qualifies, but that process can take months or years. A tradeoff worth noting: class action settlements often provide compensation amounts that are modest on a per-person basis due to the large number of class members. If 45 million people are in the class, even a $100 million settlement would average just over $2 per person. However, a class action remains the most efficient mechanism for holding large companies accountable for widespread privacy violations. Individual lawsuits would be impractical for small damages, so class actions represent the primary vehicle for consumer compensation in privacy cases of this magnitude.
What Are the Common Issues and Limitations in This Case?
One major limitation is proving causation between the secret data collection and any direct financial harm to individual consumers. Allstate might argue that the data influenced rate decisions, but isolating the specific premium increase attributable to Arity’s tracking rather than other underwriting factors is complex. Insurance companies use many variables to determine rates: driving history, age, zip code, type of vehicle, annual mileage, previous accidents, and more. Even if the court finds that Allstate improperly used Arity data, calculating the precise damage owed to each consumer becomes difficult. This limitation could reduce settlement values or narrow the eligible class to consumers who can prove specific damages. Another significant issue is the ongoing data retention question.
Even if Allstate is found liable for secretly collecting data, important questions remain about what happened to the trillions of data points that were collected. Was that data deleted after the lawsuits commenced? Is it still being sold to other insurance companies? Are there cached copies stored in multiple locations? Without transparency about data retention and deletion, consumers cannot be fully assured that the surveillance has actually stopped. A settlement might require Allstate to delete the Arity data, but verifying deletion and preventing future misuse requires rigorous oversight mechanisms that not all settlements include. A warning about settlement expectations: even favorable settlements in privacy cases often provide compensation primarily through cash payments to class members, with the remainder going to attorneys’ fees and court costs. If you receive a claim approval notification, examine exactly what compensation you receive compared to what the company has agreed to pay overall. In some privacy settlements, the actual per-person payouts are remarkably small—sometimes less than $10 per affected consumer. This reflects both the difficulty of calculating damages in privacy cases and the reality that class action settlements prioritize holding companies accountable rather than making consumers completely whole financially.
How Did This Surveillance Escape Notice for So Long?
Allstate’s surveillance architecture was deliberately obscured through multiple layers of separation. Allstate didn’t directly install SDKs in consumer apps; instead, it created Arity as a subsidiary that marketed its tracking software to app developers under the guise of providing analytics and performance monitoring services. App developers often integrate third-party SDKs without fully understanding all the data flows they enable, particularly in subscription or free apps where revenue models depend on data monetization. By making the Arity SDKs appear to be standard app analytics tools, Allstate could embed surveillance into millions of devices without transparency.
The consumer-facing disclosure of this data collection was minimal and obscured. Allstate’s terms of service and privacy policies would have technically covered data collection through Arity, but consumers rarely read these documents, and when they do, they’re written with language intentionally difficult to understand. A typical consumer who downloaded GasBuddy for fuel discounts and Life360 for family safety would have no reason to suspect that the apps were collecting detailed driving behavior data and transmitting it to Allstate in real time. The surveillance was invisible by design, relying on the fact that most people don’t read app privacy policies and assume that location-based apps need location data but nothing more.
What Does This Mean for Insurance Privacy and Future Regulation?
The Allstate Arity case is likely to accelerate state and federal privacy regulation focused specifically on insurance practices. Texas’s first enforcement action under its comprehensive privacy law sends a message that legislatures expect regulators to actively prosecute privacy violations, not simply rely on private litigation. If other states follow Texas’s lead and bring similar enforcement actions against Allstate or other insurers engaged in questionable data practices, the company’s liability exposure could increase significantly.
More importantly for consumers, heightened enforcement creates regulatory pressure on insurance companies to end secretive data collection practices. The case also highlights a gap in existing privacy protections: even when a company technically discloses data collection in privacy policies, the disclosure might be so obscure that it fails to constitute meaningful consent. Federal and state regulators appear increasingly willing to argue that consent obtained through buried disclosures in lengthy terms of service documents isn’t genuine consent at all. This argument could reshape how insurance companies are permitted to collect and use behavioral data going forward, potentially requiring explicit opt-in mechanisms rather than opt-out disclosure buried in privacy policies.
Conclusion
Allstate and Arity collected driving behavior data from over 45 million Americans through secret tracking embedded in popular mobile apps, then sold that data and used it to increase insurance rates—all without meaningful consumer consent. The Texas Attorney General’s lawsuit and multiple pending federal class actions represent the first serious legal consequences for this surveillance infrastructure. While individual settlement payouts may be modest due to the large number of affected consumers, the litigation serves the crucial function of holding insurance companies accountable for privacy violations and creating financial pressure for change.
If you were an Allstate insurance customer during the period when Arity was collecting data through Life360, Routely, GasBuddy, or Fuel Rewards, you are likely eligible to file a claim in one or more pending class actions. Monitor reputable legal information sources for settlement announcements, which will include specific claim filing instructions and deadlines. While class actions are not a complete remedy for privacy violations, they represent the most effective mechanism available for consumers to recover compensation for widespread surveillance and demand transparency from insurance companies about their data practices.
You Might Also Like
- Progressive Snapshot Privacy Class Action Claims Driver Data Was Collected Without Proper Consent
- U-Haul Data Breach Class Action Claims Customer Driver’s License Information Was Exposed
- Travelers Data Breach Class Action Claims Insurance Customer Information Was Exposed
Open Settlements You Can Claim Now
Browse current class action settlements accepting claims — several require no proof of purchase: