Your Insurance Company Knows You Better Than You Think
Category: Data & Privacy
Who's Buying Your Data? | Part 1 of 10
The Texas Lawsuit: A Wake-Up Call
In January 2025, a landmark lawsuit was filed by Texas Attorney General Ken Paxton, marking the first enforcement action under any state's comprehensive privacy law. The target? Allstate Insurance and its subsidiary, Arity. The allegations were staggering: Allstate had secretly collected driving data from over 45 million Americans through everyday apps like Life360, GasBuddy, Fuel Rewards, and MyRadar. This data, recorded every 15 seconds, built what was described as the "world's largest driving behavior database." The disturbing consequence? This information was allegedly used to raise insurance rates, deny coverage, and even drop customers entirely, often without their knowledge or explicit consent.
This real-world case highlights a pervasive and often unseen aspect of modern life: the intricate web of data collection and its impact on our most essential services, including insurance. The intricate dance between our digital footprint and the companies that profit from it is complex, and understanding its implications is crucial for safeguarding our privacy and financial well-being. As we navigate an increasingly data-driven world, the question isn't just who is buying our data, but how they are using it – and what we can do to regain control.
The Tracking Machine Inside Your Phone
How Apps Became Surveillance Tools
The mechanism behind the Allstate case is a stark illustration of how seemingly innocuous apps can become instruments of surveillance. Arity, Allstate’s data analytics subsidiary, entered into agreements with app developers. In exchange for payment, these developers embedded tracking software into their applications. When you downloaded an app like GasBuddy to find cheaper fuel or Life360 to monitor your children's whereabouts, this hidden code began diligently recording your movements and behaviors.
According to the Texas lawsuit, the integrated software captured a comprehensive range of data points, including:
- Precise Geolocation: Your phone's location was logged at 15-second intervals, creating a detailed breadcrumb trail of your daily life.
- Vehicle Dynamics: Accelerometer data provided insights into your driving habits, such as how sharply you brake or accelerate.
- Driving Parameters: Key information like speed, bearing, GPS time, longitude, and latitude were meticulously recorded.
- Distraction Indicators: The software could even infer whether you were likely engaged in distracted driving.
Beyond Apps: The Car as a Data Source
The data collection operation didn't stop at mobile applications. The lawsuit further alleged that Allstate actively purchased driver data directly from major automakers. Vehicles from brands like Toyota, Lexus, Mazda, Chrysler, Dodge, Fiat, Jeep, Maserati, and Ram were reportedly contributing to this data pool. This means that even the car you drive could have been reporting on your behaviors, adding another layer to the extensive profiling conducted by Arity.
This interconnectedness of devices underscores a fundamental shift in how personal data is gathered. Your smartphone, once a tool for communication and information, has become a powerful sensor, and increasingly, your vehicle is joining its ranks.
## The Real Cost: Your Wallet
The Impact of Driving Scores on Insurance Rates
The primary concern raised by Attorney General Paxton was how Allstate and Arity allegedly used this vast trove of data. The accusation is that they "harvested data from unsuspecting drivers and used it to justify increasing premiums, denying coverage, or even dropping coverage." This practice directly impacts consumers' financial stability and access to essential insurance.
The timing of these revelations is particularly telling. In 2024, auto insurance rates in Texas saw a significant increase of 23%, with full coverage averaging $2,915 per year. While various factors contribute to rising insurance costs, the practices described in the Allstate case suggest that the burgeoning data broker economy is playing a substantial role.
Consumers with poor Arity driving scores faced the brunt of these consequences, experiencing elevated rates and outright denials of coverage. The real injustice lies in the fact that these individuals had no awareness of these scores, no means to access them, and therefore, no opportunity to challenge their accuracy or contest the decisions based upon them.
"Allstate and Arity paid and incentivized app developers to integrate Arity's tracking software into their apps, allowing the software to record data every 15 seconds. The lack of clear notice and informed consent has sparked outrage."
This lack of transparency is a recurring theme in the data economy, leaving individuals vulnerable to decisions made about them based on information they never knew was being collected or used.
## Beyond Auto: Health Insurance's Data Addiction
While the Allstate case is particularly dramatic, it represents just one facet of a much larger privacy concern. Health insurers have long been engaged in the practice of purchasing consumer data from brokers. However, the scope of this data extends far beyond traditional medical records, delving into deeply personal and often sensitive aspects of a person's life.
A joint investigation by ProPublica and NPR brought to light that health insurers are actively acquiring "huge amounts of non-health-related data" about their customers and potential customers. This includes highly personal attributes such as:
- Demographic Identifiers: Race and ethnicity, which can be used in insidious ways.
- Financial Standing: Net worth and income estimates that paint a picture of economic status.
- Consumer Behavior: Detailed purchase histories and patterns that reveal individual habits.
- Legal Records: Information on criminal and civil court proceedings.
- Lifestyle Indicators: TV viewing habits and purchasing preferences, such as buying plus-size clothing.
The extent of this data acquisition is alarming. Blue Cross Blue Shield of North Carolina, for instance, acquired data on over 3 million individuals, focusing on "health-related actions" gleaned from their consumer purchases. Erin Kaufman, a former data analyst for Aetna, resigned due to the ethical concerns surrounding these practices. She revealed that Aetna had amassed data on millions of customers, encompassing details about gun ownership, the types of firearms owned, subscribed magazines, and personal hobbies.
"Insurance companies, for example, regularly buy personal data to inform insurance pricing. If data in there is inferred or portrayed incorrectly, that could result in an erroneous spike in someone's rate." — Justin Sherman, data broker expert
While insurers often claim they do not use this non-health-related data for individual pricing decisions, the ACLU rightly points out that there is no definitive legal prohibition preventing them from doing so. This creates a significant regulatory gap, leaving consumers exposed to potential discriminatory practices.
## The Discrimination Problem
When Data Embeds Societal Biases
The implications of health insurers acquiring such extensive personal data extend into the realm of discrimination, even if not explicitly intended. The Affordable Care Act (ACA) provides crucial protections against discrimination based on pre-existing conditions and gender. However, it offers no comparable safeguards against discrimination based on race, religion, national origin, or other sensitive attributes that can be inferred or directly gleaned from data brokers.
The ACLU has highlighted a critical issue: more than half of U.S. states do not explicitly prohibit the use of race in health insurance pricing. This loophole, combined with the inherent biases within data broker information, creates a fertile ground for systemic discrimination against minority groups.
The ACLU explains that "historical and ongoing racial discrimination has created an enormous racial wealth gap." Because society remains highly segregated, data collected by brokers often reflects and perpetuates these existing racial disparities. When predictive models are trained on this inherently biased data, individuals from minority communities are consistently placed at a disadvantage. For example, a Black individual with a credit score equal to or exceeding that of a white individual might be charged higher premiums simply due to living in a neighborhood algorithmically flagged as "risky," a designation based on historically biased data.
While civil rights laws like the Equal Credit Opportunity Act, the Fair Housing Act, and Title VII offer protections in lending, housing, and employment, respectively, a significant void exists within civil rights law when it comes to insurance. This leaves consumers vulnerable to discriminatory practices that are subtly embedded within algorithmic decision-making.
"Junk Inferences": When Bad Data Costs You Money
Even when overt discrimination is not the primary objective, the information provided by data brokers is often fundamentally flawed. Data brokers do not merely collect factual information; they engage in extensive inferential analysis. They make predictions and assumptions about individuals based on their browsing history, purchasing patterns, and even their residential location. These "junk inferences," as they are sometimes called, can be inaccurate to a significant degree, yet they still have a tangible impact on insurance rates.
"This has not changed over the years — in 2024, the quality of consumer profiles sold by many data brokers shows no improvement over what we measured eight years ago."
A compelling example of this problem involved a consumer who discovered that data brokers had incorrectly flagged him as having certain health conditions that he did not have. He expressed his concern that this misinformation "could potentially be used in discriminatory ways to make decisions that are completely wrong," affecting "everything from my ability to access services, to the premiums I am charged, to how companies might score me for risk."
Further illustrating this issue, a report from the Connecticut Attorney General documented a case where a national cremation service targeted advertisements towards an individual who had recently completed chemotherapy. This targeting was based on inferred health status, highlighting how such inferences, even if sometimes accurate, can be intrusive and offensive.
The most concerning aspect of these "junk inferences" is the absence of any legal requirement for insurers to disclose the specific data points that led to a rate increase. This lack of transparency means consumers often cannot dispute inaccurate information that is directly impacting their financial well-being.
Life Insurance: Your Social Media Could Kill Your Claim
The Growing Threat of Social Media Scrutiny
Life insurance companies have discovered a new and lucrative avenue for risk assessment: your social media profiles. During the initial two-year "contestability period" after a policy is purchased, insurers retain the right to investigate claims and deny them if they find evidence of misrepresentation from the policyholder. Increasingly, this scrutiny extends to platforms like Instagram, Facebook, and TikTok.
Photographs depicting activities such as excessive drinking, cannabis use, or participation in "risky hobbies" like skydiving and rock climbing can be leveraged to deny claims. A single tagged photo from a social gathering could be interpreted as evidence of undisclosed risk factors, potentially voiding a policy when your loved ones need it most.
Furthermore, health and wellness tracking apps, including period tracking applications like Flo, Clue, and Ovia, have become a significant concern. Data related to menstrual cycles, fertility, and pregnancy, often shared with these apps for convenience, could potentially be sold to insurers. This information might then be used to influence access to life insurance policies, loans, or other financial products. Your most intimate health decisions, managed through apps that promised to simplify your life, could inadvertently be used against you precisely when your family requires financial protection.
The GM Scandal: Your Car Is a Data Broker
Connected Cars and Unseen Data Collection
The Allstate case is far from an isolated incident. In 2024, a class-action lawsuit brought to light allegations that General Motors, in conjunction with LexisNexis, had utilized the subscription-based OnStar program to illegally track driving behavior. This collected data was then reportedly sold to third parties, including auto insurers. Customers who subscribed to OnStar, expecting enhanced safety features and navigational assistance, found themselves unknowingly enrolled as subjects in a sophisticated surveillance operation. Their driving data was packaged and distributed without their meaningful consent, demonstrating a pattern of concerning data monetization practices within the automotive industry.
This situation exemplifies a broader trend: the increasing ubiquitousness of data collection across numerous personal devices and services. Your car, your mobile applications, your wearable fitness trackers, and even your smart home devices are all potential sources of valuable data for an insurance industry eager to build comprehensive profiles on every individual.
## What You Can Do
Taking Back Control of Your Data
The pervasive erosion of privacy within the insurance sector is not an inevitable outcome. Consumers can and should take proactive steps to protect their personal information and challenge these practices. Here’s how to fight back:
Audit Your Apps Regularly
- Review Location Permissions: Go through your smartphone settings and identify which apps have access to your location data.
- Disable Unnecessary Access: For any app that does not absolutely require continuous location tracking to function (e.g., GasBuddy only needs location to find nearby stations, not to track you every 15 seconds), revoke its permission.
Understand Your Connected Car Features
- Read Service Agreements: Connected car services, such as OnStar or similar offerings from other manufacturers, often include data-sharing provisions in their terms and conditions.
- Weigh Privacy Costs: Carefully consider whether the benefits provided by these services outweigh the potential privacy implications of sharing your driving data.
Request Your Consumer Reports
- Know Your Rights: Under the Fair Credit Reporting Act (FCRA), you have the legal right to request copies of your consumer reports from major credit reporting agencies, including data aggregators like LexisNexis.
- Identify Data Holdings: Use this opportunity to review what information these agencies have compiled about you and identify any inaccuracies. You can request a free report annually from each of the three major credit bureaus (Experian, Equifax, TransUnion) and also from other consumer reporting agencies.
Be Strategic About Social Media Usage
- Assume Public Visibility: Treat all public posts on social media as if they are accessible to insurers and other entities.
- Review Privacy Settings: Regularly update and fine-tune your privacy settings on all social media platforms to limit who can see your content.
- Consider Content Carefully: Reflect on what your shared content might reveal about your lifestyle, habits, and potential risk factors.
Advocate for Stronger Privacy Legislation
- Contact Your Representatives: Urge your elected officials to support and enact comprehensive federal privacy laws. Such legislation is crucial for establishing baseline protections for all consumers.
- Support Regulatory Initiatives: Stay informed about proposed rules and regulations from agencies like the Consumer Financial Protection Bureau (CFPB). For instance, the CFPB's proposed rules in December 2024 aimed to classify certain data brokers as consumer reporting agencies, which would grant consumers more rights to access and dispute their data. CFPB Proposed Rule on Data Brokers (December 2024)
Utilize Privacy-Enhancing Tools
- Seek Data Removal Services: Services like ZoraSafe can assist you in identifying which companies hold your data and provide tools and guidance for requesting its removal. Knowledge of who has your data is the foundational step toward regaining control over it.
The Bottom Line
Insurance companies have historically been in the business of assessing risk. This fundamental principle, however, has been dramatically reshaped by the rise of the data broker economy. What was once a process of evaluating tangible factors has transformed into a surveillance apparatus that relentlessly tracks your every movement, makes inferences about your most private details, and leverages this information to increase your costs, often without your genuine knowledge or explicit consent.
The lawsuit filed against Allstate in Texas may represent one of the first significant enforcement actions, but it is likely not the last. As consumers become increasingly aware of how their personal data is being exploited, and as regulatory bodies begin to take decisive action, the insurance industry will inevitably face a period of reckoning.
Until then, your most potent defense remains awareness. Understand that your apps are watching, your car may be reporting, and the price you pay for insurance is no longer solely determined by your driving record or health status. It is increasingly influenced by a shadow profile constructed from thousands of data points you never agreed to share.
Your data is valuable, and it's time to stop giving it away for free.
This is Part 1 of "Who's Buying Your Data?" — a 10-part investigation into the companies and organizations purchasing your personal information from data brokers. Next week: Your Employer.
Sources:
- Texas Attorney General Press Release: State of Texas v. Allstate Insurance Company (January 2025) - Official Press Release (Hypothetical link for demonstration)
- ProPublica/NPR Investigation: Health Insurers Are Vacuuming Up Details About You - ProPublica Article
- ACLU: Big Data Could Set Insurance Premiums. Minorities Could Pay the Price. - ACLU Report
- The Record: 'Junk Inferences' by Data Brokers Are a Problem for Consumers - The Record Article
- Brennan Center for Justice: Closing the Data Broker Loophole - Brennan Center Analysis
- CFPB Proposed Rule on Data Brokers (December 2024) - CFPB Newsroom
- Excerpt: How Allstate built the 'world's largest driving behavior database' using 45 million Americans' phones — and they never knew. - News Source Example (Hypothetical link for demonstration)
Hashtags
#Cybersecurity #DataPrivacy #DigitalSafety #PrivacyMatters #InsurTech #DataBrokers #ConsumerRights #TechPrivacy #ZoraSafe #StaySafeWithZora #ZoraProtects #Awareness #PrivacyProtection #Surveillance #InformationSecurity