23 votes

Texas sues Allstate Insurance over its collection of driver data

12 comments

  1. [6]
    DefinitelyNotAFae
    (edited )
    Link
    I have Allstate and use their tracking app because I need the discount, but this is them acquiring that data from other apps like Gas Buddy or Life360. There's a difference IMO between consenting...

    I have Allstate and use their tracking app because I need the discount, but this is them acquiring that data from other apps like Gas Buddy or Life360. There's a difference IMO between consenting to the tracking and not.

    At the same time, my inherent bias says "Texas is doing this? Seems sus." And so I'm mostly ignoring that gut reaction for the moment.

    23 votes
    1. [2]
      JCPhoenix
      Link Parent
      I have State Farm and I use their driver tracker thing. Some people think I'm crazy for doing that, but to me, at least State Farm is "paying me" -- a hefty discount on premiums -- for my data. In...

      I have State Farm and I use their driver tracker thing. Some people think I'm crazy for doing that, but to me, at least State Farm is "paying me" -- a hefty discount on premiums -- for my data. In most other situations with others app and devices, no one is giving me shit for my data.

      And this is the perfect example. I've used Life360 before, such as when traveling international as a group. Great for trying to figure out where people are, if some are lost, etc. But Life360 didn't give me anything for that data. And now they're selling it to others like Allstate? That's wrong. By both parties. Either Allstate, or any insurer, gets the data from me directly and "pays" me for it, or they get nothing at all.

      9 votes
      1. jackson
        Link Parent
        fwiw my State Farm agent told me the discount was almost entirely based on miles driven and that I could uninstall the app and still get the 10% discount (which I did). I only used them for a year...

        fwiw my State Farm agent told me the discount was almost entirely based on miles driven and that I could uninstall the app and still get the 10% discount (which I did). I only used them for a year before selling my car, but they never kicked me off.

        4 votes
    2. [2]
      Baeocystin
      Link Parent
      I feel kind of the same way when I read about the feud between the Koch brothers and Trump. Surprised, but if they burn their resources against each other, it's almost certainly a net win for the...

      At the same time, my inherent bias says "Texas is doing this? Seems sus." And so I'm mostly ignoring that gut reaction for the moment.

      I feel kind of the same way when I read about the feud between the Koch brothers and Trump. Surprised, but if they burn their resources against each other, it's almost certainly a net win for the rest of us regardless.

      4 votes
      1. DefinitelyNotAFae
        Link Parent
        Yeah like I said I'm stomping down on that gut reaction, but I'll take privacy wins where I can get them.

        Yeah like I said I'm stomping down on that gut reaction, but I'll take privacy wins where I can get them.

        3 votes
    3. Plik
      Link Parent
      Lmao, yeah my immediate reaction to the title was "wait, Texas doing something right?!".

      Lmao, yeah my immediate reaction to the title was "wait, Texas doing something right?!".

      1 vote
  2. [4]
    RNG
    Link
    I'm skeptical, how could they have possibly connected a Life360 or GasBuddy user with a specific Allstate member? Name alone doesn't seem sufficient.

    I'm skeptical, how could they have possibly connected a Life360 or GasBuddy user with a specific Allstate member? Name alone doesn't seem sufficient.

    2 votes
    1. Eji1700
      Link Parent
      There's entire databases that work on connecting unique identities to people and converting their activity from "john doe" to "person x1232892". That said, all you really need for 99% of cases is...

      There's entire databases that work on connecting unique identities to people and converting their activity from "john doe" to "person x1232892".

      That said, all you really need for 99% of cases is name + year of birth.

      12 votes
    2. redwall_hp
      Link Parent
      If you have two or three data sets with some overlapping properties, you can deduce with very high certainty who someone is. For example, if I'm Allstate, I know your home address. If I have a set...

      If you have two or three data sets with some overlapping properties, you can deduce with very high certainty who someone is.

      For example, if I'm Allstate, I know your home address. If I have a set of location histories from GasBuddy, I just need to look for a phone that tends to be around that address for a few hours every night in your time zone. That narrows it down pretty far...and that's just by analyzing the location data itself. (Life360 is basically malware people voluntarily install, so I'm sure it has even more data.)

      An installed app can collect other information that can be cross referenced, and if you've installed the Allstate app, there's a pretty good chance both apps can build a fingerprint to connect their data sets just by various device identifiers. iOS and Android try to sort of keep unique hardware identifiers, like your IMEI or MAC addresses, from leaking to apps these days, but various ID numbers have been used for tracking purposes.

      With so many apps secretly selling data to brokers, there are many ways that data from a few apps can be put together to unanonymize location data.

      Location data also exposes a lot once you put a name to it, because many things can be inferred. You could filter by people who work for a company, simply by looking for phones that are there during office hours every day. You could then look for interesting places those phones go, other phones they spend time around, etc. and you have instant groundwork for blackmail if you're trying to do social engineering.

      5 votes
    3. unkz
      Link Parent
      from the actual filing, https://www.texasattorneygeneral.gov/sites/default/files/images/press/Allstate%20and%20Arity%20Petition%20Filed.pdf

      from the actual filing,

      https://www.texasattorneygeneral.gov/sites/default/files/images/press/Allstate%20and%20Arity%20Petition%20Filed.pdf

      On information and belief, the Arity SDK Data in isolation could not (or at least could not reliably) be linked to a specific individual. To allow Defendants to match specific individuals to the Arity SDK Data, the app publishers licensed the personal data that they collected from their users to Defendants. The personal data that mobile apps licensed to Defendants generally included first and last name, phone number, address, zip code, mobile ad-ID (“MAID”), device ID, and ad-ID (collectively, “Personal Data”). Upon combining the Personal Data with the
      Arity SDK Data, Defendants could more reliably identify the specific person being monitored by the Arity SDK.

      4 votes
  3. hobbes64
    Link
    The Article mentions that they also sued General Motors last year. As far as I know all of the automakers are tracking data, and probably illegally.

    The Article mentions that they also sued General Motors last year. As far as I know all of the automakers are tracking data, and probably illegally.

    1 vote
  4. Sodliddesu
    Link
    Distraction, right? Abbott wants people talking about this instead of the vouchers he's doing his best to shove down Texan's throats. His boy Paxton lost out after his intimidation campaign so...

    Distraction, right? Abbott wants people talking about this instead of the vouchers he's doing his best to shove down Texan's throats. His boy Paxton lost out after his intimidation campaign so they've got to do something to prove... Woke insurance companies are an industry they'll take on click their tongues at since the state didn't get a cut. C'mon guys, they already know they Texan runs every red light because they're staring at their phones.

    1 vote