Texas Attorney General Accuses Arity of Violating Data Privacy Laws
Texas Attorney General Ken Paxton has issued a notice of violation to Arity, a data broker owned by Allstate, for allegedly failing to comply with the Texas Data Privacy and Security Act (TDPSA). The notice, sent on November 29 and later made public, accuses Arity of failing to clearly notify consumers about the types of data it gathers and processes. It also claims the company sold sensitive data without user consent, raising concerns about privacy and ethical use of personal information.
Who Is Arity?
Arity was founded by Allstate in 2016 and specializes in mobility data and analytics. According to the company’s website, it aims to improve transportation efficiency by analyzing vast amounts of driving data.
Arity collects and interprets driving behavior using trillions of miles’ worth of data acquired through various sources such as mobile devices, in-car technology, and vehicles themselves. Its unique data set reportedly gives insurers, developers, and marketers nuanced insights into driver habits. Arity claims these insights help predict driving behavior and could potentially make roads safer.
A company press release describes Arity’s work as foundational to understanding how people move. It emphasizes that its data-driven approach benefits insurers and communities alike. However, the way in which this data is obtained and used has now come under legal scrutiny.
Allegations of Non-Compliance with TDPSA
Paxton’s notice claims Arity has violated several provisions of the TDPSA, a law that has been effective in Texas since July 1 and governs how businesses collect, use, and protect Texans’ personal data. Specifically, Paxton accuses the company of the following violations:
-
Lack of Clear Consumer Notice: Arity allegedly failed to provide a transparent explanation of the types of sensitive data it collects. This leaves consumers unaware of how their personal information is being used.
-
No Consent for Sensitive Data: The company reportedly processed sensitive consumer information without obtaining consent. This includes collecting data via a software development kit (SDK) in third-party mobile applications.
-
Geolocation and Movement Tracking: One key allegation is that Arity gathered precise geolocation data and tracked phone movement speeds through its SDK, without clearly informing users or seeking their approval.
-
Selling Data Without Consent: Paxton’s office claims sensitive driving data was sold to car insurance providers, further violating privacy norms.
Such practices, as outlined in Paxton’s notification, could undermine trust in the rapidly growing field of mobility data analytics.
Other Examples of Data Privacy Issues in the Auto Industry
The controversy surrounding Arity echoes other recent cases involving data mismanagement in the car insurance and data broker industries. Earlier this year, New York Attorney General Letitia James fined GEICO and Travelers Indemnity Co. a total of $11.3 million following an investigation into poor data security protocols.
The New York probe revealed that inadequate safeguards exposed over 130,000 New Yorkers to identity theft. Hackers exploited weak security in auto insurance quoting systems to steal personal data such as driver’s license numbers and dates of birth. This information was subsequently used to file fraudulent unemployment claims during the COVID-19 pandemic. The fallout from such incidents emphasizes the critical need to prioritize data security across industries.
How Data Analytics Improves Auto Safety
Despite these issues, mobility data analytics—when used responsibly—offers a range of benefits for improving road safety. Arity’s initiatives, in particular, highlight some of the ways this technology can enhance driving experiences:
- Enhanced Crash Prevention: Analytics can identify risky driving behavior, enabling targeted interventions by insurers or vehicle manufacturers.
- Roadway Improvements: Data provides insights into high-accident zones, helping cities prioritize infrastructure upgrades or changes in traffic design.
- Customizable Insurance Rates: Usage-based insurance policies reward safer driving, encouraging individuals to be more cautious on the road.
- Driver Education: Insights from driving patterns can inform tailored driver training programs to reduce reckless behavior.
- Accurate Emergency Response: Real-time data helps emergency responders locate crash sites more quickly, potentially saving lives.
While the benefits are clear, these advantages must be balanced with strict adherence to privacy laws and ethical standards.
Responsible Use of Data in the Future
The growing adoption of mobility data highlights the importance of striking a balance between innovation and privacy. With advancements in technology, companies can collect rich data sets that hold remarkable potential to reshape industries and improve lives. However, the case against Arity demonstrates the pitfalls of failing to secure consumer consent or provide transparency.
Moving forward, organizations engaging in data-driven initiatives must prioritize clear communication with users, robust security measures, and strict compliance with regulations like the TDPSA. By adhering to these standards, we can leverage technology to improve road safety, streamline services, and enhance lives—all while protecting the privacy rights of individuals.