State Farm is the largest U.S. auto and home insurer, structured as a mutual company (State Farm Mutual Automobile Insurance Company as lead entity, owned by policyholders rather than shareholders) with a family of affiliated insurance, life, and asset-management subsidiaries. Its privacy notices describe standard insurance-sector collection (application, claim, and driving-record data) plus optional usage-based telematics through the Drive Safe & Save program, which scores acceleration, braking, and speeding events via the State Farm app and a Bluetooth beacon. State Farm's ad-tech disclosures describe conventional interest-based advertising (cookies, device IDs, mobile ad IDs shared with ad partners), and its CCPA notice self-declares a "Sale and Sharing" category with Global Privacy Control honored. As a mutual insurer, State Farm does not file SEC disclosures, so ownership evidence comes from its own site rather than securities filings. No FTC/state-AG enforcement action over data practices was found; the one documented security incident is a 2019 credential-stuffing attack against online accounts, which State Farm disclosed itself and characterized as exposing only login-credential confirmation, not broader PII.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
10 ON FILE
COLLECTION
State Farm's Drive Safe & Save page states the driving data collected through the app and Bluetooth beacon is scored on acceleration, braking, and speeding events (exceeding the speed limit by 8+ mph), and that this feedback is used to calculate the customer's discount.
State Farm's GLBA privacy notice states it collects consumer information directly from the customer (address, phone number, via correspondence/interviews) and from non-State Farm companies such as driving record and claim history sources.
State Farm's Notice of Privacy Policy states, under "Our Privacy Principles," that "We do not sell customer information," where the notice defines customer information as "all nonpublic information related to an identified individual." That principle is scoped to the notice's own definition of customer information: State Farm's separate California privacy rights page self-declares a CCPA "Sale and Sharing" category covering personal information collected through cookies and tracking technologies and shared with third-party digital businesses, so the no-sale statement does not extend to all personal information as the CCPA defines it.
State Farm's company-overview page directs visitors to "examine how we manage the business as a Mutual Company," self-describing its ownership structure as a mutual insurer rather than a publicly traded, shareholder-owned corporation.
State Farm's privacy notice page lists the full family of companies covered by its privacy practices, led by State Farm Mutual Automobile Insurance Company, followed by affiliated fire/casualty, general, indemnity, life, and investment-management entities.
State Farm's California privacy rights page self-declares a "Sale and Sharing" category of personal information under the CCPA involving Third-Party Digital Businesses collecting data via cookies/tracking technologies, and states State Farm has configured its consent platform to receive and honor Global Privacy Control (GPC) opt-out signals.
State Farm's GLBA privacy notice states consumer information may be shared within the State Farm family of companies and disclosed to persons or organizations inside or outside that family with consent, to complete a requested transaction, or as permitted or required by law.
Security Magazine reported that State Farm disclosed a July 2019 credential-stuffing attack against its online accounts, filing a data breach notification with the California Attorney General; State Farm's own breach-notification email said a bad actor used externally sourced credential lists to attempt account access and confirmed valid user IDs and passwords for affected accounts.
State Farm's About Our Ads page discloses use of browser cookies, local shared objects, mobile advertising/device IDs, and analytical tools, and states it shares website cookie IDs, web beacons, and mobile device IDs with ad partners and vendors to serve interest-based advertising.