{"id":2041,"date":"2025-02-24T09:48:14","date_gmt":"2025-02-24T13:48:14","guid":{"rendered":"https:\/\/blogs.duanemorris.com\/classactiondefense\/?p=2041"},"modified":"2025-02-24T09:48:15","modified_gmt":"2025-02-24T13:48:15","slug":"data-privacy-class-action-alleges-insurers-improperly-collected-the-data-of-40-million-users-through-third-party-applications","status":"publish","type":"post","link":"https:\/\/blogs.duanemorris.com\/classactiondefense\/2025\/02\/24\/data-privacy-class-action-alleges-insurers-improperly-collected-the-data-of-40-million-users-through-third-party-applications\/","title":{"rendered":"Data Privacy Class Action Alleges Insurers Improperly Collected The Data Of 40 Million Users Through Third-Party Applications"},"content":{"rendered":"
\n
\"\"<\/a><\/figure>\n<\/div>\n\n\n

By Gerald L. Maatman, Jr., Justin Donoho, George J. Schaller, Ryan T. Garippo<\/strong><\/p>\n\n\n\n

Duane Morris Takeaways<\/em>: <\/strong>In Mahoney, et al. v. The Allstate Corp<\/a>, et al., 25-CV-01465 (N.D. Ill. Feb. 11, 2025), Plaintiffs Michael Mahoney and Scott Schultz (collectively, \u201cPlaintiffs\u201d) filed a putative class action lawsuit asserting Allstate, and its subsidiary Arity, illegally obtained personal driving data of 40 million policyholders through third-party mobile application software.\u00a0 The case is pending in the U.S. District Court for the Northern District of Illinois before Judge Steven C. Seeger.This is the third lawsuit in a series of lawsuits alleging class-wide allegations based on Allstate\u2019s alleged data collection practices.\u00a0 See Sims et al. v. The Allstate Corp. et al<\/a>., 1:25-CV-00407 (N.D. Ill. Jan. 14, 2025) (alleging data collection through third party application Sirius XM); see also Arellano et al. v. The Allstate Corp. et al.<\/a>, 1:25-CV-01256, (N.D. Ill. Feb. 5, 2025) (alleging data collection through third party applications Life360, GasBuddy, and Fuel Rewards).\u00a0<\/em><\/p>\n\n\n\n

Mahoney, Sims, and Arellano, represent a triumvirate of data privacy class actions centered on allegations of improper data collection through third-party applications.  Companies will be well-served monitor these cases for their novel assertions in trending data privacy litigation.<\/em><\/p>\n\n\n\n

Complaint Allegations<\/strong><\/p>\n\n\n\n

Michael Mahoney resides in San Francisco, California, and he downloaded the GasBuddy application in 2011 to \u201cfind competitive gas prices.\u201d  Mahoney, 25-CV-01465, <\/em>ECF No. 1 \u00a7 III \u00b6 14 (N.D. Ill. Feb. 11, 2025)<\/em>.  Scott Schultz resides in Highland Park, Illinois, and he downloaded the GasBuddy application in 2021 and used it \u201cin his own and other people\u2019s vehicles to find competitive gas prices.\u201d  Id.<\/em> \u00a7 III \u00b6 15.<\/p>\n\n\n\n

Plaintiffs collectively allege that Allstate and its subsidiary Arity (collectively, \u201cDefendants\u201d) \u201cconspired to collect drivers\u2019 geolocation data and movement data from mobile devices, in-car devices, and vehicles.\u201d  Id. <\/em>\u00a7 IV \u00b6 7.  Plaintiffs allege Defendants designed a software development kit that could be integrated into third-party mobile applications such as \u201cRoutely, Life360, GasBuddy, and Fuel Rewards.\u201d  Id. <\/em> \u00a7 IV \u00b6 8.  Plaintiffs further allege Defendant advertised that they \u201ccollect data \u2018every 15 seconds or less\u2019 from 40 million<\/em> \u2018active mobile connections\u2019 and \u2018derive[] unique insights that help insurers, developers, marketers, and communities understand and predict driving behavior at scale.\u201d  Id.<\/em> \u00a7 IV \u00b6 24.<\/p>\n\n\n\n

Plaintiffs contend Defendants\u2019 software development kit was \u201cdesigned to and does collect data\u201d including \u201cGeolocation data and \u2018GPS Points,\u2019\u201d \u201ccellphone accelerometer, magnetometer, and gyroscopic data,\u201d \u201cTrip attributes\u201d data (including start and end locations, trip distances, trip duration), \u201cDerived events\u201d data (including acceleration, speeding, distracted driving, crash detection), and \u201cMetadata.\u201d  Id.<\/em> \u00a7 IV \u00b6 11 (A) \u2013 (E).  Plaintiffs further assert that when using these third-party applications \u201cDefendants could collect real-time data on their locations and movements and surreptitiously collect highly sensitive and valuable data directly from Plaintiffs\u2019 mobile phones.\u201d  Id. <\/em>\u00a7 IV \u00b6 16.<\/p>\n\n\n\n

It is also important to note that Plaintiffs maintain that Defendants used their personal data to \u201cdevelop, advertise, and sell several products and services to third parties, including insurance companies . . .\u201d and used the purchased consumer data for \u201c[Defendants\u2019] own underwriting purposes.\u201d  Id. <\/em>\u00a7 IV \u00b6 23.  Plaintiffs, ultimately, assert that Defendants real purpose in using this data is for their \u201cown financial and commercial benefit\u201d and to obtain \u201csubstantial profit.\u201d  Id. <\/em>\u00a7 V \u00b6 49.  They ultimately assert via their nine-count Complaint that this technology amounts to a wiretapping of their personal information which entitles them, inter alia<\/em>, to a sum of \u201c$100 per day per violation or $10,000\u201d per class member whichever is greater.  Id. <\/em>\u00a7 V \u00b6 51.<\/p>\n\n\n\n

Implications For Companies<\/strong><\/p>\n\n\n\n

Although such data collection lawsuits are no longer a new phenomenon, their scope has become far more aggressive as the plaintiffs\u2019 bar continues to look for ways to monetize lawsuits against corporations using such technologies.<\/p>\n\n\n\n

Take for example the dilemma presented by Mahoney<\/em>.  In that case, it is likely that Defendants will have strong defenses to this action.  For example, Plaintiffs admit that Defendants\u2019 purpose in using this technology was to earn \u201csubstantial profit.\u201d  Id. <\/em>\u00a7 V \u00b6 49.  Based on similar allegations, many courts have found that these purposes are insufficient for a plaintiff to avail itself of such wiretapping statutes.  See, e.g., Katz-Lacabe v. Oracle Am<\/em>., Inc.<\/em>, 668 F. Supp. 3d 928, 945 (N.D. Cal. 2023) (dismissing wiretap claim because defendant\u2019s \u201cpurpose has plainly not been to perpetuate torts on millions of Internet users, but to make money.\u201d).<\/p>\n\n\n\n

There are, however, enough court rulings that come out in the opposite direction to give a corporate defendant pause.  See, e.g., R.S. v. Prime Healthcare Services, Inc.<\/em>, No. 24-CV-00330, 2025 WL 103488, at *6-7 (C.D. Cal. Jan. 13, 2025) (recognizing the split and siding with the plaintiffs).  And, if Plaintiffs are correct that there are 40 million individuals in the class, and that each class member is entitled to $10,000 at a minimum, then this lawsuit alleges at least $400 billion dollars in liability.  Even if there is a 1% chance of success on these claims, it would suggest that the completely unrealistic figure of $4 billion dollars is on the table.<\/p>\n\n\n\n

Corporations in these types of class actions are faced with the difficult choice of settling the claims for an astronomical figure based on the use of technologies which are ubiquitous in nature (like software development kits for mobile applications) or defend a $400 billion lawsuit based on defenses in an area of the law which is not fully developed.  It will be interesting to see how the Mahoney <\/em>defendants balance these concerns as the case progresses, because many twists and turns lie ahead.<\/p>\n\n\n\n

In the meantime, corporate counsel should take the opportunity to evaluate their companies\u2019 data collection and privacy policies to make sure their companies are not easy targets.  If the allegations in Mahoney <\/em>are any example, the mere threat of one of these lawsuits should be enough to keep corporate counsel up at night.  And, if their companies are ultimately sued in one of these lawsuits, they should ensure that an experienced defense team has its hands on the steering wheel. <\/p>\n","protected":false},"excerpt":{"rendered":"

By Gerald L. Maatman, Jr., Justin Donoho, George J. Schaller, Ryan T. Garippo Duane Morris Takeaways: In Mahoney, et al. v. The Allstate Corp, et al., 25-CV-01465 (N.D. Ill. Feb. 11, 2025), Plaintiffs Michael Mahoney and Scott Schultz (collectively, \u201cPlaintiffs\u201d) filed a putative class action lawsuit asserting Allstate, and its subsidiary Arity, illegally obtained personal … <\/p>\n

Continue reading “Data Privacy Class Action Alleges Insurers Improperly Collected The Data Of 40 Million Users Through Third-Party Applications”<\/span><\/a><\/p>\n","protected":false},"author":575,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[91],"tags":[],"ppma_author":[7,122,96,127],"class_list":["post-2041","post","type-post","status-publish","format-standard","hentry","category-data-breach-class-actions"],"authors":[{"term_id":7,"user_id":575,"is_guest":0,"slug":"gmaatman","display_name":"Gerald L. Maatman, Jr.","avatar_url":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-content\/uploads\/sites\/56\/2022\/09\/maatmangerald-100x100.jpg","0":null,"1":"","2":"","3":"","4":"","5":"","6":"","7":"","8":""},{"term_id":122,"user_id":686,"is_guest":0,"slug":"jrdonoho","display_name":"Justin Donoho","avatar_url":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-content\/uploads\/sites\/56\/2025\/02\/donohojustin-1-100x100.jpg","0":null,"1":"","2":"","3":"","4":"","5":"","6":"","7":"","8":""},{"term_id":96,"user_id":655,"is_guest":0,"slug":"gschaller","display_name":"George Schaller","avatar_url":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-content\/uploads\/sites\/56\/2023\/07\/schallergeorge-100x100.jpg","0":null,"1":"","2":"","3":"","4":"","5":"","6":"","7":"","8":""},{"term_id":127,"user_id":692,"is_guest":0,"slug":"rgarippo","display_name":"Ryan Garippo","avatar_url":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-content\/uploads\/sites\/56\/2024\/09\/garipporyan-100x100.jpg","0":null,"1":"","2":"","3":"","4":"","5":"","6":"","7":"","8":""}],"_links":{"self":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts\/2041","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/users\/575"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/comments?post=2041"}],"version-history":[{"count":0,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts\/2041\/revisions"}],"wp:attachment":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/media?parent=2041"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/categories?post=2041"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/tags?post=2041"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/ppma_author?post=2041"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}