Texas AG sues Allstate and Arity over alleged unlawful collection and sale of driving data
The Texas Attorney General filed a lawsuit against Allstate and its subsidiary Arity, alleging unlawful collection, analysis, and sale of driving data from over 45 million Americans without proper notice or consent. The action centers on a lack of transparency in Arity’s data collection pipeline and consent mechanisms, with multiple independent sources corroborating the filing.
Allegations claim Allstate and Arity secretly collected and monetized driving data without notice or consent.
Key facts
- What
- The Texas Attorney General filed a lawsuit against Allstate and its subsidiary Arity, alleging unlawful collection, analysis, and sale of driving data from over 45 million Americans without proper notice or consent.
- Incident date
- Jan 13, 2025
- Who
- Allstate Insurance and its subsidiary Arity
- Failure mode
- Data Leakage
- AI surface
- Search / RAG
- Severity
- High
What happened
On January 13, 2025, the Texas Attorney General filed a lawsuit against Allstate and its subsidiary Arity, alleging unlawfully collecting, analyzing, and selling driving behavior data from more than 45 million Americans without proper notice or consent. The filing claims the data were used for insurance pricing and other commercial purposes, highlighting a lack of transparency and a consent mechanism in the Arity data pipeline.
What broke inside the model
- 01 · TriggerA request triggers retrieval or context loading.
- 02 · Model stepThe context pulls in another user's content.
- 03 · Control gapNo boundary enforces isolation at the moment of output.
- 04 · FailurePrivate data crosses into the response.
- 05 · ConsequenceOne user sees another's data, and disclosure follows.
One user's content crosses the retrieval boundary into another's response.
The mechanism described involves a production AI telematics data pipeline allegedly collecting, analyzing, and monetizing driving data without proper notice or consent. The alleged failure is in transparency and consent mechanisms rather than a technical defect in an AI system.
What it cost
Sources
- PrimaryAttorney General Ken Paxton Sues Allstate and Aritytexasattorneygeneral.gov
- PressWilmerHale privacy blogwilmerhale.com
- PressBleepingComputer FTC GM location datableepingcomputer.com
Cite this entry
https://failureindex.ai/failures/texas-sues-allstate-arity-alleged-unlawfulAI Failure Index. "Texas AG sues Allstate and Arity over alleged unlawful collection and sale of driving data" (FI-0226). Realm Labs. https://failureindex.ai/failures/texas-sues-allstate-arity-alleged-unlawful (indexed Jun 5, 2026).Data fields CC-BY 4.0, prose citation permitted. Incident ID FI-0226. Full dataset at /data.
Note from Realm Labs, the Index steward
How Realm would have caught this
- Prism
- OmniGuard
- AI Detection & Response (AIDR)
Realm can detect when a response is about to emit data that falls outside the bounds of the current user and context, and block or redact it inline, at the moment of generation rather than after the data has left.