United States of America: Texas Attorney General filed lawsuit against Allstate over alleged unlawful collection, use, and sale of user data

On 13 January 2025, the Texas Attorney General filed a lawsuit against Allstate and its subsidiary, Arity ("Allstate") for the alleged unlawful collection, use, and sale of location data from its users' mobile phones. The suit alleges violations of the Texas Data Privacy and Security Act (TDPSA), the Data Broker Law, and the Texas Insurance Code. The suit claims that Allstate covertly collected location data from 45 million consumers nationwide, including Texans, through embedded software in mobile apps and monetised the data by selling it to insurers and using it to adjust premiums and coverage. The alleged violations include failure to provide notice or obtain consent, non-compliance with data broker registration requirements, and unfair practices in the business of insurance. The Attorney General seeks penalties under the TDPSA of up to USD 7'500 per violation, under the Data Broker Law of up to USD 10'000 per violation plus daily fines for non-registration, and under the Insurance Code of up to USD 10'000 per violation, alongside restitution, data deletion, injunctive relief, and legal costs. The case represents the first enforcement of data privacy laws by a state attorney general and proceeds to discovery and trial.