Unauthorized Sharing of Location and Driving Data Draws Scrutiny from Texas AG, Illinois Class, and FTC

Want to receive these privacy recaps in your inbox each week? Subscribe here.

USA

Allstate Data Collection Leads to Texas AG and Illinois Class Action Claims

Within one day of each other, Allstate and its subsidiary data analytics company Arity were sued by the Texas Attorney General’s Office and a class of Illinois drivers, making claims under different laws over the same activity–collection of location and driving data from users of third-party apps without sufficient privacy disclosures or consent.

The Texas Attorney General’s Office claims the activity violates the Texas Data Privacy and Security Act, which requires clear notice and informed consent regarding how a company will use Texans’ sensitive data (including location data), the Texas Data Broker Law, and the Texas Insurance Code,  while the Illinois class action claims the activity violates the Federal Wiretap Act, the federal Computer Fraud and Abuse Act, and common law invasion of privacy.

TAKEAWAY

It is not uncommon for class action claims to follow quickly in the footsteps of regulator activity.

For example, Kochava, which has been defending FTC actions against it for years over the mobile data broker’s sale of individuals’ precise location information without consent, has settled class actions in multiple states over the same activity.

Online counseling platform Betterhelp has also been the subject of both FTC and class action claims over its data use and sharing.

The possibility of receiving multiple, piggy-backed claims from regulators and private plaintiffs raises the stakes of data collection activity that may run afoul of multiple laws across multiple jurisdictions, especially with an increasing number of states with comprehensive privacy laws and active privacy enforcement resources. 

Watch our webinar on-demand to learn more about privacy litigation trends in the U.S.

FTC Files GM Complaint and Finalizes Mobilewalla and Gravy Analytics Orders

The Federal Trade Commission had a productive week, filing a complaint against General Motors and finalizing orders with Mobilewalla and Gravy Analytics, all over the sale of sensitive location data to third parties without user consent. 

TAKEAWAY

Sensitive location data has been a clear focus area of the FTC over the last few years. These latest cases are in addition to previous cases against Kochava, X-mode and Inmarket. The FTC also previously issued a blog post warning that “Browsing and location data are sensitive. Full stop“, that “collecting, storing, using, and sharing people’s sensitive information without their informed consent violates their privacy”, and that the FTC would use all of its tools to continue to protect Americans from “abusive data practices and unlawful commercial surveillance”.       

Download our chart outlining the differences between sensitive data definitions across the U.S.

Want more of the privacy highlights that matter for consent management and digital marketing? Sign up for our privacy newsletter, A Little Privacy, Please.

A Little Privacy, Please weekly recaps are provided for general, informational purposes only, do not constitute legal advice, and should not be relied upon for legal decision-making. Please consult an attorney to determine how legal updates may impact you or your business.