How Allstate’s data broker Arity sells driver data

Allstate’s data broker arm sells access to millions of drivers’ data online

Hans Isaacson | Unsplash.com

Take Action

In 2016, Allstate announced it was spinning up a new technology company: Arity. While Arity’s original purview was developing tech for insurance companies to run usage-based insurance programs – where users allow their driving to be tracked via an app in order to receive insurance discounts for good driving – Arity’s business model has since expanded significantly. 

Today, Allstate’s Arity sells access to millions of drivers’ data to third parties for purposes beyond saving drivers money on their insurance. Arity is part software developer, part data broker and part AdTech company, collecting, buying and reselling driving data to third parties, both for scoring drivers for insurance purposes and for its targeted advertising business. 

Knowing when, where and how people drive is valuable information. Insurance companies want to know if people are safe drivers. Advertisers want to know when and where people shop. And retailers want to know if they have customers driving by their store to a competitors’. 

Now Arity and its parent company Allstate are facing a lawsuit from the Texas Attorney General alleging that the companies’ data practices have violated the Texas Data Privacy and Security Act by failing to inform or get consent from users before collecting and selling their data.

Allstate and Arity are far from the only companies collecting and monetizing people’s data in ways that may surprise the people whose data is being sold. But they provide a useful example for understanding how companies can use apps to collect unnecessary amounts of data – particularly sensitive data, like your location – and use it in ways you’re not expecting. 

Arity’s data collection practices

Arity collects a lot of data – over a trillion miles of driving data since its founding at a current rate over 1 billion miles a day. According to the company, it collects data from tens of millions of drivers in the U.S. at minimum.

The data Arity collects includes real-time geolocation data, what time of day a person drives, what route they take, and other driving behavior such as how often they speed, check their phone, or slam on the brakes. It can collect this data from smartphone apps that it has developed for insurance companies, from third party apps it has embedded tracking software in, from on-board devices in cars, and in some cases from connected cars themselves.

When Arity functions as the service provider for a usage-based insurance program – where consumers opt-in to having their driving behavior tracked in exchange for discounts, as in the case of Allstate’s Drivewise, which Arity operates – collecting data about how people drive makes sense. 

What makes less sense is that Arity sometimes collects driving data in ways that are not intuitive to consumers, and uses it for purposes beyond rewards for good driving that a consumer has opted into.

Arity collects data from third party apps

Arity uses technology it embeds in third party apps that are unrelated to usage-based insurance programs to collect data about drivers. Apps in general are notorious for their capacity to collect excessive amounts of information. Downloading an app on your phone can often allow the app developer to collect lots of information from your device, including your real-time location.

Arity collects data about people’s location and driving habits through partnerships with third party apps such as GasBuddy, an app for finding low gas prices’ Life360, a family location tracking app; and MyRadar, a weather app. It’s also previously partnered with WeatherBug

Arity offers software development kits for companies to include in the background of their apps. Known as SDKs for short, these pieces of code enable a company or person making an app to collect data from a person’s phone. Incorporating one of Arity’s SDKs allows both the app developers and Arity to collect and receive geolocation and driver behavior data from consumers’ phones. Arity pays to receive this data from the apps. 

Amongst Arity’s SDKs is Driving Engine, which “enables a mobile app to detect, record, and score your end-user’s driving behavior”. This SDK collects location data from a person’s phone once every 15 seconds, and can create a “trip summary for a user for a selected period of time”. It also includes a Scoring API, generating a “driving score” between 1-100. 

Insurance companies may use Arity’s SDK offerings as the data collection mechanism for their usage-based app, where users consent to data collection for discounts. However, Arity advertises that its SDKs can be used to collect driving data from consumers for other reasons, such as “enhancing” an app’s first-party data collection, making inferences about people’s “lifestyle” based on when and where they drive (such as determining their work schedule) , and collecting data for targeting ads.

Arity collects data from connected cars and auto manufacturers

According to Arity, it also receives data from on-board devices in cars and in some cases connected “smart” cars themselves. 

Arity has announced partnerships with Ford for collecting data from internet-connected Ford and Lincoln vehicles and with Connected Analytic Services, a Toyota affiliate, to collect data from Toyota and Lexus connected cars. Both of these partnerships, according to the companies involved, are for the purposes of offering and implementing usage-based insurance for consumers.

According to the Texas Attorney General’s suit against Arity, the company purchased data from Toyota, Lexus, Mazda, Chrysler, Dodge, Fiat, Jeep, Maserati, and Ram.

Arity also appears to have a partnership with SiriusXM, raising the possibility it may receive data from the company’s devices.

Arity’s data-driven businesses

There are two primary components of Arity’s data business we’ll cover here: for scoring drivers for insurance companies, and for targeted advertising.

Scoring drivers

Arity provides products for insurance companies looking to do personalized pricing. This includes providing the software for insurance companies running opt-in telematics programs collecting data on how consumers drive who have signed up to receive discounts.

Arity also provides software for insurance companies to provide instant quotes to new prospective customers through its product ArityIQ, a database that allows insurance companies to “access actual driving behavior collected from mobile phones and connected vehicles to use at time of quote to more precisely price nearly any driver.” According to the company, ArityIQ is “the world’s largest driving behavior database tied to claims” and made up of the data of over 40 million drivers.

Data in the ArityIQ database is collected through one of Arity’s mobile SDKs embedded in the background of an app. According to Arity, this data is collected from consumers who “opt-in to share driving data in apps they use every day”. However a New York Times investigation from last year found the mechanisms for getting consent for Arity’s data collection in apps such as Life360 and GasBuddy used vague language that didn’t necessarily make the data practices clear.

Pricing insurance based on how someone drives can be a good thing for consumers, if they really opt in to the program. Right now, car insurance is often priced off of proxies such as someone’s credit score and marital status – factors that don’t have anything to do with how well you drive. 

But it’s not clear that the driver data Arity collects is supplanting those practices. In a promotional video for ArityIQ, it states that “instant driving behaviors” are made available alongside data such as “credit history, demographic data” and “vehicle information”. And it’s unclear to what extent consumers knew their data was being used in this way, or could appeal those decisions. 

According to the Texas AG’s lawsuit, insurers could use consumers’ data “to justify increasing their car insurance premiums, denying them coverage, or dropping them from coverage.”

“The world’s largest driving behavior data base for targeted advertising”: Arity’s AdTech business

Arity collects significant amounts of data about when, where and how people drive. In addition to telematics programs, Arity runs a targeted advertising business that lets companies use consumers’ driving data for targeting ads. In fact, Arity claims it has amassed “the world’s largest driving behavior database for targeted advertising”. According to its privacy policy, it “retain[s] Mobile Ad IDs and geolocation information used to serve targeted advertising for up to 3 years from the date of collection.”

Much of Arity’s advertising business is geared towards the insurance industry. Using data such as how often someone speeds, Arity classifies drivers on a scale from 1-10 based on how they drive – and how profitable they are likely to be for insurance companies. Insurers can then target ads for policies to consumers that Arity has identified as low-risk drivers – or alternatively be used by insurers with “a niche strategy focused on higher risk drivers”.

However, Arity makes its data about how, when and where people drive available to other industries for targeting ads as well, such as auto manufacturers and car dealers, car parts and maintenance stores, gas stations, fast food restaurants and other retail operations. 

There are three basic components of Arity’s ad business. First is selling access to data with its Arity Audiences product on third-party marketplaces. Second is through its in-house marketplace called Arity Marketing Platform. And third is through its lead generation and marketing platforms for insurance companies, LeadCloud and Transparent.ly.

Arity Audiences and the Arity Marketing Platform

Arity collects and aggregates consumer driving data from a range of sources into “audiences” – bundles of consumers that companies can pay to use for targeting ads. Its Arity Audiences product appears to contain data from well over 100 million Americans: its website claims it can generate “insights” on almost 175 million U.S. drivers. During a 2023 panel held by the prominent AdTech company LiveRamp, Arity’s Director of Product Marketing said:

“We have connections to over 200 million U.S. drivers. We get driving data – so data literally about how these people drive their cars – from connections in mobile apps we partner with and devices in cars. We gather this data from over 200 million drivers…We synthesize all the data into audiences that are available on the LiveRamp marketplace. What marketers can do with this data is reach people based on when, where and how they drive.”

Arity still maintains a listing on LiveRamp, as well another large online data marketplace theTradeDesk.

Arity claims that the data it monetizes via Audiences is in aggregated and anonymized bundles. Aggregating and anonymizing consumer data helps cut down on some of the risks associated with data monetization, but it does not stop reaching people on an individual level based on data. High-tech tools connected to these third party data marketplaces allow companies to target and reach selected individuals based on traits like geographic location or driving habits.

Arity has advertised that its Audiences include segments identifying commuters, gig drivers, fast food customers and active duty military. Arity’s Predictive Point of Interest audiences let advertisers use trip data to target consumers based on when and where they drive.  

Arity Audiences are also available in Arity’s Marketing Platform, its own “private marketplace”.  Advertisers and app developers can use this in-house platform to access driver data for targeting ads. Arity paints its product as a way to still do targeted advertising based on driving data even as certain forms of tracking – like web cookies and mobile ad IDs – are falling away. 

How Arity data can be used for ad targeting

Arity offers a number of possible use cases. Maybe a car dealer wants to target drivers who speed a lot with ads for sports cars. Or maybe auto repair shops may want to target ads to high risk drivers that are more likely to need frequent or expensive repairs. A retailer may want to target ads at people who drive by their store on the way to a competitor’s. Or a gas station may want to target someone who usually drives past their store at 6 PM before they get in the car.

According to Arity, driving data can be revealing of “psychographic information” and be used to define an individual’s personality and lifestyle in a way useful for advertisers. It suggests, for example, that using driving data can identify people who “venture off their typical routes on weekends and holidays” that may be considered “adventure seekers,” or people “who are often on their phones while on the road” as “busy multitaskers”. For the latter, Arity suggests that companies may want to target ads for productivity software. 

Arity is right that our location data about how we move through the world can be very revealing. That sensitivity means it should be treated with extra care, and not made available on AdTech marketplaces.

Arity’s lead generation business – LeadCloud and Transparent.ly

Arity also provides tools for lead generation. It runs LeadCloud, a digital platform and marketplace where data sellers, call centers and insurance companies can exchange data about individuals and contract with one another for their services. Over 200 companies are connected to the marketplace, providing services including “lead scoring, lead verification, call-center services, and data appending”. According to the company, its data marketplace even includes “a growing list” of Internet of Things providers, including telematics and smart home companies. LeadCloud also includes “real time decisioning” services, using “lead data and appended Service Provider data”.

Transparent.ly is another part of Arity’s insurance advertising business. Transparent.ly is a real-time bidding platform that caters to the lending world, including auto insurance, mortgages and higher ed insurance companies. Transparent.ly advertises that it “ingests dozens of consumer attributes and other relevant factors to enable advertisers to target consumers” including a consumer’s location, demographics, credit score and the type of device they’re using. It also owns a number of websites, including TheCarInsuranceGuide.com, that it targets ads on. As the company states, “[b]y combining Transparent.ly’s high-intent audiences with Arity’s risk analysis, marketers can now optimize their bidding based on the lifetime value of the consumer” – how profitable a particular policyholder may be.

Companies shouldn’t collect unnecessary data, and use it for irrelevant purposes

Anytime a company collects data in ways people aren’t expecting, or isn’t necessary for delivering the services a consumer is expecting to get, it’s a bad deal for consumers. It violate people’s trust – and it fuels our rising data security problem. The more data companies collect, the longer they store it, and the more widely they share it with other companies, the more likely it is that information will be eventually exposed in a breach or a hack. In the case of sensitive data like location information, it can be particularly dangerous for the people whose data is being sold. Even when location data is anonymized, it is not difficult to re-identify. With only two GPS pings – where someone drives to in the evening, and where they drive to in the morning – an individual can be picked out of a dataset with relative ease. 

Allstate and its subsidiary Arity should commit to being transparent with people about its data collection practices, and stop monetizing people’s data for purposes beyond providing people the insurance they’ve signed up for.

Topics
Authors

R.J. Cross

Director, Our Online Life Program; and Don't Sell My Data Campaign, PIRG

R.J. focuses on the intersection of tech and people. Her work ranges from the risks of commercialization of personal data, to consumer harms like scams and data breaches, to manipulative targeted advertising, to keeping kids safe online. In her work at Frontier Group, she has authored research reports on government transparency, consumer debt and predatory auto lending, and has testified before Congress. Her work has appeared in WIRED magazine, CBS Mornings and USA Today, among other outlets. When she’s not protecting the public interest, she is an avid reader, fiction writer and birder. Though she lives in Boston, she will always consider herself a Kansan at heart.

Nico Vacca

Intern, Don't Sell My Data Campaign