Your Driving Data Is Being Sold to Insurers
In January 2025, the Texas Attorney General sued Allstate and its data subsidiary Arity for
secretly embedding tracking software inside popular mobile apps — including family safety
apps millions of parents downloaded to monitor their children — and using the data collected
to build insurance rate profiles for 45 million Americans who never consented to be tracked.
This was not a data breach or a hack. It was a deliberate business model: pay app developers
to install tracking code, collect continuous driving data in the background, and sell that
data to insurers to justify raising premiums. The consumers whose data was collected had no
idea it was happening and no way to review or dispute the profiles being built about them.
How the Arity tracking system worked
Arity is an Allstate subsidiary that describes its product as a driving behavior analytics
platform. Rather than asking drivers to install a dedicated telematics app, Arity paid
third-party app developers to embed its tracking SDK directly into their existing apps.
When users ran those apps — for navigation, family location sharing, or other everyday
purposes — Arity's code recorded their movement, speed, braking behavior, and location
continuously in the background.
Life360, a family location app with tens of millions of users, was specifically named in
the Texas AG complaint as an app that embedded Arity's software. Parents who downloaded
Life360 to track their teenagers' whereabouts were simultaneously generating a detailed
driving profile that Allstate used to price insurance. The Texas AG described the resulting
database as the "world's largest driving behavior database" — trillions of miles of data
from over 45 million Americans.
No notice. No consent. Higher premiums.
The Texas lawsuit alleged that Allstate and Arity never provided meaningful notice that
driving data was being collected, never obtained informed consent, and never told consumers
that the data would be used to influence their insurance rates. When a consumer applied for
a quote or renewed a policy, Allstate would access their Arity-built profile and use it to
set or increase their premium — without the consumer knowing such a profile existed or
having any opportunity to dispute it.
This is the first enforcement action ever filed by a state attorney general under a
comprehensive consumer data privacy law. The Texas Data Privacy and Security Act requires
clear notice and informed consent before collecting sensitive geolocation data. The AG
concluded that Allstate and Arity met neither requirement.
Allstate and Arity are not alone
The same office filed a separate lawsuit against General Motors for secretly collecting
and selling drivers' detailed driving data through OnStar and connected vehicle systems.
The Texas AG has announced ongoing investigations into several other car manufacturers
over the same category of conduct. Similar data-sharing arrangements between automakers,
data brokers, and insurers have been reported at Ford, Honda, Hyundai, Kia, and others.
The common thread is that the data was not collected by an app the driver chose for
mileage tracking — it was collected passively by systems the driver did not know were
recording, through agreements the driver never saw, and transferred to parties the driver
had no relationship with.
What you can do
Review location permissions for every app on your phone. Any app with "always on"
location access that does not need continuous location for its core function is a
candidate for data collection you did not intend to authorize. Revoking background
location access and switching to "only while using the app" reduces the exposure window
significantly.
For mileage tracking specifically, the alternative to continuous auto-tracking is
intentional manual logging. MileHawk records only the trips you choose to log, accesses
your location only at the moment you start a trip, and does not run in the background.
Your trip history is stored in the cloud for your own use — it is not sold to insurers,
data brokers, or any third party.
Frequently asked questions
What is Arity and what does it collect?
Arity is a data analytics company and subsidiary of Allstate Insurance. Its core product is a driving behavior database built by embedding tracking software inside third-party mobile apps — apps unrelated to insurance or mileage, including navigation and family safety tools. When users run those apps, Arity's SDK records their location, speed, braking, and movement patterns continuously. The Texas AG lawsuit describes this database as the "world's largest driving behavior database," covering trillions of miles of data from over 45 million Americans.
How did Allstate get access to my driving data without my consent?
According to the Texas Attorney General lawsuit filed in January 2025, Arity paid mobile app developers to incorporate its tracking software directly into their apps. The tracking ran silently inside apps consumers downloaded for unrelated purposes. Users were not told their driving data was being collected, nor were they told it would be sold to insurance companies. The Texas AG alleged this violated the Texas Data Privacy and Security Act, which requires clear notice and informed consent before collecting sensitive geolocation data.
Which apps embedded Arity's tracking software?
The Texas AG complaint specifically names Life360, a popular family location and safety app, as one of the apps that incorporated Arity's SDK. Life360 had tens of millions of users who downloaded it to track their children's whereabouts — not to share their own driving data with an insurance company. The AG's investigation suggested this was a broader pattern across multiple apps, not limited to a single developer.
Can insurance companies raise my rates based on driving data from an app?
Yes, and that is exactly what the lawsuit alleges happened. When a consumer applied for a quote or renewed their policy, Allstate and other insurers would access the driving profile built from that consumer's app data — often without the consumer knowing such a profile existed — and use it to justify higher premiums. The consumer had no opportunity to review, correct, or dispute the data being used to price their coverage.
Is this only an Allstate and Arity problem?
No. The Texas AG lawsuit against Allstate and Arity followed a separate lawsuit by the same office against General Motors for secretly collecting and selling drivers' detailed driving data. The AG also announced ongoing investigations into several other car manufacturers. The pattern — collecting granular driving data without meaningful consent and monetizing it — is an industry-wide practice, not an isolated incident.
What legal action has been taken?
On January 13, 2025, Texas Attorney General Ken Paxton filed suit against Allstate and Arity, alleging violations of the Texas Data Privacy and Security Act. This was the first enforcement action ever filed by a state attorney general under a comprehensive data privacy law. The AG's office has also filed a separate lawsuit against General Motors and opened investigations into other automakers over the same category of conduct.
Does this affect me if I don't live in Texas?
The Texas lawsuit covers Texas residents, but Arity's data collection was nationwide — the 45 million figure is a national count. Residents of other states may have limited remedies today depending on their state's privacy laws, but the data that was collected about them exists regardless of whether their state has filed its own action. Several other states have enacted or are enacting comprehensive data privacy laws modeled on frameworks similar to the one Texas used here.
How can I find out if an app on my phone is tracking my driving data?
There is no reliable in-app disclosure for this. Arity's tracking was embedded inside apps whose primary function had nothing to do with driving data. Your best approach is to review the privacy policy of any app that has location permission on your phone, looking for references to third-party data sharing, telematics, driving analytics, or insurance partnerships. If the policy mentions sharing location or behavioral data with data brokers or insurance partners, assume that permission is being used. Revoking location access for apps that do not need it for their core function is a practical first step.
Does MileHawk share my driving data with insurance companies or data brokers?
No. MileHawk does not sell your trip history or personal data to third parties. The app is supported by non-intrusive mobile ads — that is the business model, not data monetization. Your location is accessed only at the moment you choose to log a trip; MileHawk does not run continuous background tracking. You own your mileage data and control what you export and share.
Also see: GPS Mileage Auto-Tracking Pitfalls
·
IRS Mileage Deduction Audit Risks
