Texas Data Law

Insight

Driving-Data Allegations Show How an SDK Can Feed a Data Supply Chain

What the Texas pleadings and FTC order show about collection, consent, and onward transfers.

Litigation and Enforcement · Technology and platforms · Automotive · Event date: August 13, 2024 (GM petition); January 13, 2025 (Allstate and Arity petition) · For general counsel, privacy leads, and business operators

Two Texas lawsuits describe the same pipeline from two ends. In one, the data left the car itself. In the other, it left apps that had nothing to do with insurance. In both, the Attorney General alleges, it ended up pricing Texans' car insurance. What follows distinguishes the State's allegations, the FTC consent order's binding obligations, and adjudicated findings: The FTC order imposes obligations on its respondents; the Texas petitions assert violations of independently applicable statutes, In the Allstate and Arity action, the 457th District Court entered judgments on April 10, 2025 and November 7, 2025 in trial cause 25-01-00561 (the April 10, 2025 judgment granting the special appearance and dismissing claims for lack of personal jurisdiction, per Bloomberg Law); both judgments are on appeal in the Fifteenth Court of Appeals (Nos. 15-25-00082-CV and 15-25-00213-CV), submitted May 21, 2026, with no appellate disposition in the reviewed official case-event records.

Route one: the vehicle

On August 13, 2024, the Attorney General sued General Motors (Cause No. 24-08-12392, 457th District Court, Montgomery County). The petition alleges that technology in most 2015 and newer GM vehicles collected detailed data about every drive, and that GM sold it to several companies. At least two allegedly turned it into "Driving Scores" and sold them to insurers. The State says GM enrolled customers in products such as OnStar Smart Driver during vehicle onboarding and told them that declining would disable safety features. More than 1.5 million Texans were affected, by the State's count. The claims sound in false, deceptive, and misleading practices.

The federal record has moved further. The FTC issued its final GM and OnStar order on January 13, 2026, and announced it the next day. Part I bars disclosure of covered driver data to consumer reporting agencies for five years. Part II requires affirmative express consent for separate, unrelated services or features that collect, use, or disclose that data, subject to specified exceptions. Parts VI and VIII address previously retained data and deletion requests to sharing partners, with qualifications. Those obligations arise from the order and should not be treated as findings in the separate Texas lawsuit.

Route two: the SDK

On January 13, 2025, the Attorney General sued Allstate and its subsidiary Arity, in what the office characterized as the first enforcement action under any state's comprehensive privacy law. The petition alleges that Arity paid app developers to embed its software development kit in apps with location features, naming Life360, Routely, and Fuel Rewards. The kit allegedly gathered location, movement, and speed every 15 seconds or less. Arity then allegedly sold driving-behavior products to other insurers and used the data to justify higher premiums.

The State pleads three statutes:

Claim in the Allstate/Arity petitionWhat the State alleges
Count I: TDPSA, Business & Commerce Code Chapter 541Notice, sensitive-data consent, and consumer-request violations by the Arity defendants
Count II: then-Chapter 509 broker law, now Chapter 510Failure of the Arity defendants to register under the broker law then in effect
Count III: Insurance Code Chapter 541Unfair competition or deceptive insurance practices alleged against all defendants

The petition cites the broker law as then-Chapter 509; the current codification is Chapter 510. Note the two Chapter 541s: the TDPSA lives in the Business and Commerce Code, while Count III invokes the Insurance Code's unfair-practices chapter.

What the pipeline teaches

An SDK turns a single app into a data supplier. The app user consents, if at all, to the app. The data then passes to the kit's owner, then to its customers, and finally to a decision about price. Each hop is a separate legal event.

The allegations map the duty to each hop. The app that embeds the kit discloses a sale or sharing. The kit's owner, if it did not collect directly from the person, may be a data broker. Under the TDPSA, a covered controller needs consent before processing precise geolocation, which is sensitive data; processors act under their statutory role and instructions; each actor's role determines its obligation. And the business that uses the score must be ready to explain where it came from.

A company that embeds a third-party SDK should therefore know what the kit collects, where it sends the data, and whether the kit's owner resells it. A contract that is silent on resale invites the question these petitions ask.

Docket status

The official Fifteenth Court of Appeals submitted-cases list identifies State of Texas v. Arity 875, LLC, Nos. 15-25-00082-CV and 15-25-00213-CV, submitted May 21, 2026. The filed Texas petitions state allegations; they do not establish liability. The FTC order is a separate federal disposition.

Sources

Related