Allstate car insurer sued for tracking drivers without permission

[bigsky]

Be extremely careful and very selective about installing apps on your phone. Nowadays, everybody seems to have an app. Buy a piece of candy, install the app for it, too. No, thanks.
Apps mentioned I would never install on my phone. Heck, I will never install even the auto insurance company app.

At the same time, there always is and always will be somebody tracking your every move. 21st century at work.

Sponsored

 

[NY_Rob]

It's amazing and disappointing when you see what companies get away with here in the states compared to Europe with their very strict consumer protections. From food dyes, additives and labeling, to requiring cell phone batteries being replaceable by the consumer, right to repair and of course our computer and phone apps spying on us. It's like the USA is the wild west where you can just make terrible non-repairable products, completely block access to parts and schematics and install software that flat out ignores consumer privacy.

 

[NY_Rob]

And there's this too... is anyone surprised??

Apple offers $95 million in Siri privacy violation settlement

Apple has agreed to pay $95 million to settle a class action lawsuit in the U.S. alleging that its Siri assistant recorded private conversations and shared them with third parties.

The proposed lawsuit alleges that the audio data was disclosed without users' consent to a network of third-party marketers and advertisers.

Users complained of being targeted on their Apple devices with advertisements for products concerning sensitive and very specific matters discussed in private conversations, when Siri had been activated by accident.

The case, submitted by Fumiko Lopez, John Troy Pappas, and David Yacubian, on behalf of others similarly situated, accuses Apple of violations of the federal Wiretap Act and California's Invasion of Privacy Act.
Settlement agreement

According to court documents, Apple is set to create a $95 million non-reversionary fund to cover payments to class members, attorney fees, awards for class representatives, and administrative costs.

The settlement applies to all U.S.-based current or former owners of Siri-enabled devices, like iPhones, iPads, and Macs, whose communications were obtained or shared without consent due to unintentional Siri activations between September 17, 2014, and December 31, 2024.

Class members can claim up to $20 per Siri-enabled device for up to five devices, while the plaintiffs may receive up to $10,000 for their efforts.

The preliminary approval hearing is scheduled for February 14, 2025. If the case moves forward, there will be a claims submission deadline set to 135 days, on June 29, 2025.

In addition to the monetary aspect of the settlement, Apple is also required to permanently delete all Siri audio recordings obtained while in violation of the said laws within six months after the settlement's effective date.

In the future, Apple is also expected to provide clear and easily understandable disclosures about how users can manage Siri settings to protect their data from unintentional disclosure.

It is important to note that this is a proposed settlement. Depending on what objections are submitted and how the court will handle them, the final form may contain adjusted or even rejected terms.

BleepingComputer has contacted Apple to ask for a comment and a spokesperson sent us the following statement:

"Siri has been engineered to protect user privacy from the beginning. Siri data has never been used to build marketing profiles and it has never been sold to anyone for any purpose. Apple settled this case to avoid additional litigation so we can move forward from concerns about third-party grading that we already addressed in 2019. We use Siri data to improve Siri, and we are constantly developing technologies to make Siri even more private." - Apple
Putting Siri to sleep

Siri is integral to Apple software and users can take steps to adjust its sensitivity or restrict its usage from certain apps.

The first step would be to disable the voice-based "Hey Siri" activation through your device's settings by toggling off the 'Listen for Hey Siri' option. On the Apple Watch, 'Raise to Speak' is a similarly risky setting to enable.

For apps that handle sensitive data or are often active on the device, go to 'Settings > Siri & Search' and disable 'Use with Siri' for them. Also, toggle off 'Suggestions on Lock Screen' and 'Suggestions in Search.'

Finally, it's useful to regularly delete Siri and dictation history via 'Settings > Siri & Search > Siri & Dictation History' to wipe potentially sensitive data.

Update 1/6: Added Apple statement

 

[Electrified Outdoors]

The most troubling part about this is the Life360 app. So are they alleging that Allstate purchased and life360 collected & sold it to them? If so, this is very troubling. I know many parents who have life360 for family safety reasons.

The insurance app itself is not all that concerning because you have to explicitly give it permissions to access location and other sensors in your device. I have the app but it has none of those permissions. Its only there to access my ID cards when needed.

If the life360 thing is true, that is a serious violation of trust by that app. The app is there to keep families safe and selling that info to insurers is a major privacy concern!

 

[Donald Stanfield]

And there's this too... is anyone surprised??

Apple offers $95 million in Siri privacy violation settlement

Apple has agreed to pay $95 million to settle a class action lawsuit in the U.S. alleging that its Siri assistant recorded private conversations and shared them with third parties.

The proposed lawsuit alleges that the audio data was disclosed without users' consent to a network of third-party marketers and advertisers.

Users complained of being targeted on their Apple devices with advertisements for products concerning sensitive and very specific matters discussed in private conversations, when Siri had been activated by accident.

The case, submitted by Fumiko Lopez, John Troy Pappas, and David Yacubian, on behalf of others similarly situated, accuses Apple of violations of the federal Wiretap Act and California's Invasion of Privacy Act.
Settlement agreement

According to court documents, Apple is set to create a $95 million non-reversionary fund to cover payments to class members, attorney fees, awards for class representatives, and administrative costs.

The settlement applies to all U.S.-based current or former owners of Siri-enabled devices, like iPhones, iPads, and Macs, whose communications were obtained or shared without consent due to unintentional Siri activations between September 17, 2014, and December 31, 2024.

Class members can claim up to $20 per Siri-enabled device for up to five devices, while the plaintiffs may receive up to $10,000 for their efforts.

The preliminary approval hearing is scheduled for February 14, 2025. If the case moves forward, there will be a claims submission deadline set to 135 days, on June 29, 2025.

In addition to the monetary aspect of the settlement, Apple is also required to permanently delete all Siri audio recordings obtained while in violation of the said laws within six months after the settlement's effective date.

In the future, Apple is also expected to provide clear and easily understandable disclosures about how users can manage Siri settings to protect their data from unintentional disclosure.

It is important to note that this is a proposed settlement. Depending on what objections are submitted and how the court will handle them, the final form may contain adjusted or even rejected terms.

BleepingComputer has contacted Apple to ask for a comment and a spokesperson sent us the following statement:

"Siri has been engineered to protect user privacy from the beginning. Siri data has never been used to build marketing profiles and it has never been sold to anyone for any purpose. Apple settled this case to avoid additional litigation so we can move forward from concerns about third-party grading that we already addressed in 2019. We use Siri data to improve Siri, and we are constantly developing technologies to make Siri even more private." - Apple
Putting Siri to sleep

Siri is integral to Apple software and users can take steps to adjust its sensitivity or restrict its usage from certain apps.

The first step would be to disable the voice-based "Hey Siri" activation through your device's settings by toggling off the 'Listen for Hey Siri' option. On the Apple Watch, 'Raise to Speak' is a similarly risky setting to enable.

For apps that handle sensitive data or are often active on the device, go to 'Settings > Siri & Search' and disable 'Use with Siri' for them. Also, toggle off 'Suggestions on Lock Screen' and 'Suggestions in Search.'

Finally, it's useful to regularly delete Siri and dictation history via 'Settings > Siri & Search > Siri & Dictation History' to wipe potentially sensitive data.

Update 1/6: Added Apple statement

This is why I turn off the voice assistant in all my devices. I thought the wake word thing was bullshit from the very first time it was introduced. I can’t remember how many people told me I was crazy or overreacting

 

[Glembi2]

The EFF put out this guide for determining whether your vehicle is snitching on you.

https://www.eff.org/deeplinks/2024/...ws-about-you-and-opt-out-sharing-when-you-can

Edit: Now after the first coffee, here’s another one on tracking via embedded ads:
https://www.wired.com/story/gravy-location-data-app-leak-rtb/

 

[Donald Stanfield]

The most troubling part about this is the Life360 app. So are they alleging that Allstate purchased and life360 collected & sold it to them? If so, this is very troubling. I know many parents who have life360 for family safety reasons.

The insurance app itself is not all that concerning because you have to explicitly give it permissions to access location and other sensors in your device. I have the app but it has none of those permissions. Its only there to access my ID cards when needed.

If the life360 thing is true, that is a serious violation of trust by that app. The app is there to keep families safe and selling that info to insurers is a major privacy concern!

Yup, the Allstate app is only bad if you follow the prompts and set up drive wise. Then it collects telematics, I have all that turned off as well.

 

[NY_Rob]

Yup, the Allstate app is only bad if you follow the prompts and set up drive wise. Then it collects telematics, I have all that turned off as well.

My agent was emphatic that our whole family install that Drive Wise garbage on our phones to get an additional discount on our premiums. We had a family meeting about it, and the vote was a unanimous "no f**king way". When I called our agent back, she found another way to get us the same discount amount without the spying app on our phones.

The problem is too many people sleepwalk through their day-to-day lives and just bend over for corporate America which gladly shafts them. They take the easy way out and they pay for that poor decision with more than just $$$.

 

[NY_Rob]

This is why I turn off the voice assistant in all my devices. I thought the wake word thing was bullshit from the very first time it was introduced. I can’t remember how many people told me I was crazy or overreacting

Agreed!

I mean, in order to hear you use the wake word, isn't your phone listening every second it's on???

 

[Donald Stanfield]

Agreed!

I mean, in order to hear you use the wake word, isn't your phone listening every second it's on???

Bingo.

 

[Helium89]

Agreed!

I mean, in order to hear you use the wake word, isn't your phone listening every second it's on???

Sort of. Usually, this is implemented with a chip that always has the last few seconds of audio stored on it. If it detects the wake word, it tells the operating system to start recording and passes it the last few seconds of audio (in case you say the wake word and start giving instructions before the operating system starts recording). If it doesn’t detect the wake word, it overwrites the old audio. Sometimes it misinterprets audio as the wake word and triggers the operating system to start recording when it shouldn’t (in which case the audio might be sent to Apple/Google/Amazon), but it isn’t constantly sending your audio.

 

[NY_Rob]

Bingo.

The sad part is, it's not a complex math proof that you need to work your way through to verify it's true, it's a simple one step concept.. but when I mention this simple idea to most people, they just shrug it off.

 

[NY_Rob]

Sort of. Usually, this is implemented with a chip that always has the last few seconds of audio stored on it.

Thanks for the detailed info, that's how it's supposed to work I guess. But in reality it seems to work differently.
If we start discussing trips to Aruba over dinner and there are phones present.. suddenly our phones are flooded with ads about vacation travel over the next couple of days. Alexa 100% is listening and makes purchase recommendations based off conversations we have had in the one specific room we have her sitting in even though we didn't ask her anything about said products.
Last spring when were were building our outdoor kitchen, we had lots of discussions on built in BBQ grills. All of a sudden, my daughter's phone started getting ads for outdoor built in BBQ grills. That's not a common thing for a mid 20yo girl to be shopping for and she never looked up BBQ grills because that was something my wife and I were purchasing not her.

 

[Zoidz]

Thanks for the detailed info, that's how it's supposed to work I guess. But in reality it seems to work differently.
If we start discussing trips to Aruba over dinner and there are phones present.. suddenly our phones are flooded with ads about vacation travel over the next couple of days. Alexa 100% is listening and makes purchase recommendations based off conversations we have had in the one specific room we have her sitting in even though we didn't ask her anything about said products.
Last spring when were were building our outdoor kitchen, we had lots of discussions on built in BBQ grills. All of a sudden, my daughter's phone started getting ads for outdoor built in BBQ grills. That's not a common thing for a mid 20yo girl to be shopping for and she never looked up BBQ grills because that was something my wife and I were purchasing not her.

I'm not saying nefarious things are not happening (some cases have been proven) but there is a rational technical explanation for this, with one assumption condition. I'll explain it as a scenario, you can decide if this is what actually might have occured.

Dad is thinking about a new gas grille. Dad goes online from home with his phone, or perhaps in the car with his phone, and does a few searches about gas grilles (this is the assumption). Maybe Target.com, Amazon, Google, etc.

A day later, a discussion starts about it at home. Behind the scenes, Dad's search on the phone had cookies, Facebook pixels, Google Trackers, and a ton of other tracking web tech dropped on it from the web sites visited. Without going into the gory details (which I have only a surface understanding of) as soon as any one of these things happen, there is enough underlying data collected over your browsing history that they (Facebook, Google, advertisers, etc.) can associate Dad with others in Dad's family, Dad's home IP address, etc.

So now, a family member goes online from home. The trackers have associated Dad's home IP address, Facebook ID, Gmail account, etc, etc. with Dad's previous single search on Amazon for a grill, or visit to a grill web site, and targeted ads are randomly sent to anyone surfing from the same IP address, or via any other links they can make between the individuals.

All this happens without a voice assistant actually eavesdropping on your conversation, but it makes it appear that way.

As an example, if you are interested, take a look at Hubspot.com, or LiveRamp.com, two of the dozens of companies in this space. Look at all the companies they partner with to share your data and connect the dots!

 

[Electrified Outdoors]

Trying to get to the father through his daughter...over a gas grill of all things. Have they no principles?

Sponsored