Allstate and Mass Surveillance…

Allstate is facing a major privacy class action lawsuit, filed in the Northern District of Illinois, in which it is accused of monitoring users through its associated mobile applications. The plaintiffs are thirty-nine individuals who purchased auto insurance. The individual lawsuits have been consolidated into a single action titled In re: Allstate & Arity Consumer Privacy Litigation, Master Docket No. 25 CV 407, before the Honorable Jeremy C. Daniel

The plaintiffs are represented by firms including Morgan & Morgan Complex Litigation Group, Clifford Law Offices, and Girard Sharp LLP.Sidley Austin LLPhas been retained to defend Allstate.

The lawsuit alleges that Allstate secretly collected and sold immense amounts of consumers’ driving data from mobile devices. According to the complaint, the company used this data to build what plaintiffs describe as the “world’s largest driving behavior database,” storing driving data from more than 45 million Americans.

The complaint alleges that Allstate amassed “trillions of miles” of driving data and related metrics by maintaining active connections with the mobile devices of plaintiffs, though apps such as: Routely, Life360, GasBuddy, and Fuel Rewards. Apps like Life360 informed users that it required location sharing to be turned on for the in-app map or to share location with the users authorized circle of family and friends, never mentioning the data collection and sale.

The lawsuit also lays out exactly what data the apps allegedly collect from mobile devices: geolocation, accelerometer, magnetometer, and gyroscopic data, tracking everything from the phone’s altitude, latitude and longitude, direction, GPS, speed, location. This real time data collection highlights the depth and intricacy of the alleged surveillance.

According to the complaint, Allstate used this database for its own business purposes, to increase premiums or deny coverage, and sold the information to third parties, such as other insurance carriers.

This lawsuit is unique in the cybersecurity and privacy space because it doesn’t center on a traditional cyberattack or data breach. Instead, it focuses on the collection and monetization of consumer data. The case reflects the growing wave of litigation examining how companies gather, use, and profit from the personal data of consumers, and if consumers truly consent to that level of surveillance simply by downloading an app.