Futuristic digital background. or
Texas Attorney General Ken Paxton has filed a lawsuit against Allstate and its subsidiary, Arity, accusing them of illegally collecting and selling sensitive data from more than 45 million Americans without their consent.
The lawsuit alleges that Arity paid mobile app developers millions of dollars to embed tracking software within their apps, including apps such as Routely, Fuel Rewards, GasBuddy, Life360. This software secretly collected trillions of miles of driving data from users’ cellphones, including location and movement information. The collected data was then allegedly sold to various insurance companies, including Allstate.
Attorney General Paxton claims these actions violate the Texas Privacy and Data Security Act, which mandates that companies obtain clear consent from consumers before collecting or sharing their personal data. The lawsuit seeks civil penalties of up to $10,000 per violation, along with a court order requiring Allstate and Arity to delete the improperly obtained data, Reuters reports.
This lawsuit is part of a broader initiative by the Texas Attorney General’s office to enforce data privacy laws and protect consumers from unauthorized use of data. This follows previous actions against other companies for similar violations.
Why location data matters to privacy and cybersecurity
Location data is one of the most sensitive types of personal information because it reveals where you are, where you’ve been and, by extension, aspects of who you are. For both privacy and cybersecurity, the misuse or leakage of location data can have profound implications.
Day in the Life: Tracked by your location data
It starts like any other day. You wake up at home, the phone on the nightstand. Without a second thought, you check your messages, revealing your location to a nearby cell tower. As you head to work, your phone’s GPS records your route, tracking every stoplight and turn. Your daily commute creates a digital footprint—a pattern that, over time, shows exactly where you live, play, and work.
At lunch, stop at a pharmacy to pick up a prescription. Later, you visit a counseling center or attend a meeting at your place of worship. These moments, while private and personal, are silently recorded by apps and devices, presenting a detailed picture of your habits and routines.
After work, you head to a local political rally or community event. Whether you’re there to listen or participate, your presence is recorded by location services, adding another layer to your digital profile. At the end of the day, your phone has created a near-perfect map of your movements—revealing not only where you’ve been, but potentially why you’ve been there.
This story isn’t hypothetical—it’s the reality of how location data works. From your home address to the places you visit, the information collected can reveal intimate details about your life, including aspects you might want to keep private:
- Health conditions, based on visits to specific medical facilities.
- Religious affiliations, through attendance at places of worship.
- Political views, derived from participation in rallies or protests.
When this data is tracked over time, it becomes a powerful tool for profiling individuals – sometimes with far-reaching consequences. Whether it’s used for targeted advertising, surveillance, or other purposes, the story your location data tells can be more revealing than you realize.
In digital forensics, location data plays an important role in what is known as lifestyle analysis, where movement and behavior patterns are used to profile individuals. Imagine a normal day: your phone records your location as you travel, shop and attend personal meetings. By the end of the day, apps have quietly built a map of your movements. When location data is misused or disclosed, it poses privacy and cybersecurity risks, such as tracking, identity theft, or unwarranted surveillance.
Lifestyle Analysis: Digital Forensics Case Example
In one medical malpractice case I worked on, the plaintiff suffered severe complications during a routine surgery, which led to a lifetime of additional care needs. The case hinges not only on surgical error, but also on the personal lifestyle of the operating surgeon, whose behavior in the months leading up to the procedure came under intense scrutiny.
Through the use of lifestyle analysis, I combined cell phone location data and social media posts, which along with witness statements and receipts painted a picture of the surgeon’s life in the months leading up to the incident. The analysis revealed that the surgeon’s behavior had changed dramatically after the finalization of a contentious divorce.
Cellphone records showed frequent late-night visits to bars and clubs, sometimes until 4 a.m., just hours before scheduled operations. The location data allowed attorneys and investigators to locate witnesses who reported seeing the surgeon at social events appearing drunk on multiple occasions during the work week.
Medical experts have proven that lack of sleep and potential impairment from substance use can significantly affect decision-making, reaction time and motor skills. The plaintiff’s attorneys argued that these factors likely contributed to the surgeon’s error, turning a routine procedure into a life-changing tragedy.
Forensic experts use location data to reconstruct behavior and establish patterns, but when this knowledge is obtained without consent, it becomes a breach of privacy and a gateway to potential exploitation. When misused or disclosed, location data doesn’t just show where a person has been; it reveals their routines, habits, and even deeply personal aspects of their lives, such as health conditions, religious affiliations, and political views.
Arity has been contacted for comment. This article will be updated accordingly when they respond.
