Seven years ago, Allstate Corporation told Maryland regulators it was time to update its auto insurance rates. The insurer said its new, sophisticated risk analysis showed it was charging nearly all of its 93,000 Maryland customers outdated premiums. Some of the old rates were off by miles. One 36-year-old man from Prince George’s County, Md., who Allstate said in public records should have been paying $3,750 every six months, was instead being charged twice that, more than $7,500. Other customers were paying hundreds or thousands of dollars less than they should have been, based on Allstate’s new calculation of the risk that they would file a claim.

Rather than apply the new rates all at once, Allstate asked the Maryland Insurance Administration for permission to run each policy through an advanced algorithm containing dozens of variables that would adjust it in the general direction of the new risk model. Allstate said the goal of this new customer “retention model,” which it was rolling out across the country, was to limit policy cancellations from sticker shock. After questions from regulators, the insurer submitted thousands of pages of documentation on the price changes—including data showing how they would affect each individual customer, a rare public window into details of its auto insurance pricing that have otherwise been kept behind a wall of privacy, labeled a trade secret.

When The Markup and Consumer Reports conducted a statistical analysis of the Maryland documents, we found that, despite the purported complexity of Allstate’s price-adjustment algorithm, it was actually simple: It resulted in a suckers list of Maryland customers who were big spenders and would squeeze more money out of them than others.

Customers who were already paying the highest premiums, of about $1,900 or more every six months, and were due an increase would have borne price hikes of up to 20 percent. But drivers with cheaper policies, who deserved price jumps that were just as big, would be charged a maximum increase of only 5 percent. Customers in the 20 percent group were more likely to be middle-aged.

We also found Allstate’s algorithm would have denied meaningful decreases to thousands of Allstate customers who the company’s new risk profile showed were paying too much. That 36-year-old from Prince George’s County would not have saved $3,772 on his policy as he deserved, documents show, but rather gotten a measly discount of $26. Discounts were capped at a half percent across the board.

Maryland ultimately rejected the plan, calling it discriminatory, and it never went into effect there. However, the insurer has continued to propose plans with a customer “retention model” in other states. Some have been approved and are actively being used.

Allstate declined to answer any of our detailed questions and did not raise any specific issues with our statistical analysis, which we provided to the company in November, including the code used to calculate our findings.

“Our rating plans comply with state laws and regulations,” read a short statement emailed by spokesperson Shaundra Turner Jones. The Maryland proposal, the statement said, aimed to “minimize customer disruption and provide competitive prices.”

In a later email, she added that our reporting on the Maryland filing is “inaccurate and misleading” because it is “based on a rating plan that was never used.”

Allstate’s Maryland filing reveals how an opaque algorithm it has been proposing around the country would have functioned in practice. It also offers a glimpse into a potential future where companies of all sorts, not just auto insurers, charge people different prices based on their behavior—or expected willingness to pay, as projected by algorithms that draw on the seemingly limitless troves of data collected and sold about people every day.

In this case, Allstate’s model seemed to determine how much a customer was willing to pay —or overpay—without defecting, based on how much he or she was already forking out for car insurance. And the harm would not have been equally distributed.

In Maryland, seniors were overrepresented among those customers who were owed discounts but would not have gotten them. Allstate proposed giving those Maryland customers over the age of 62 a median discount of $1.64, far less than many deserved, according to its new risk calculations.

The lost discounts to Allstate’s Maryland customers would have added up to more than $10.5 million in the first six months alone.

“That they wouldn’t have gotten these discounts would have been devastating,” said Deni Taveras, a councilmember in Prince George’s County, where Allstate determined that policyholders owed discounts were being overcharged by $265 on average, but proposed dropping their rates by pennies, for an average discount of $2.63.

“My district is highly dependent on social services, pensions and food pantries,” she said. Those hundreds of dollars would have been “huge,” a boon that “would have covered meals, it would have covered bills.”

Had Maryland approved the proposal, Allstate customers who were deprived of discounts would likely never have known. Allstate would not have been required to inform them and the National Association of Insurance Commissioners said it has never heard of an insurer doing so voluntarily.

Besides Maryland, some other states have also signaled they would not accept similar plans from Allstate. Georgia rejected Allstate’s proposal just last year.

But in at least 10 states, public records show, Allstate’s plans mention using a customer retention model: Arizona, Arkansas, Illinois, Iowa, Michigan, Missouri, Nebraska, Oklahoma, Tennessee, and Wisconsin.

Allstate wouldn’t tell us if those models work exactly the same way as the Maryland proposal and it’s impossible to know from the outside. The Markup and Consumer Reports reviewed public records for hundreds of Allstate filings and only the 2013 Maryland filing contained the granular customer data necessary for this analysis, because regulators there asked for more information than the insurer originally provided.

Of the 10 states that allowed Allstate’s retention models, only officials in Arkansas would answer our questions about why it would allow a retention model. Spokesperson Kenneth Ryan James said such proposals would not be prohibited in Arkansas, because state law only bans discrimination by insurers grouping customers “in part on race, color, creed or national origin.”

It’s unclear if other auto insurers are using personalized pricing.

Allstate certainly didn’t invent it. Some industries have been experimenting with personalized pricing for decades.

Amazon sold DVDs to different people for different prices 20 years ago—but offered to refund the difference to the overpayers after the practice was discovered, according to news reports. In the past several years, both Staples.com and Princetonreview.com were found to have been changing prices based on zip codes.

This is different from so-called dynamic pricing, where prices change so often that people can end up paying different amounts, like with airfare, because they bought at different times. Personalized prices are instead set by something that’s specific to you.

Staples defended its practice of varying prices online by zip code, even though the neighborhoods with higher prices were more likely to be poor, telling the Wall Street Journal that they reflect factors like the cost of doing business. Princeton Review said it was merely passing on the costs of providing tutoring packages to different locations—but tutoring was delivered online.

Buyers’ race, poverty and other discriminatory details can wend their way into personalized pricing algorithms through other factors, even if that’s not the intent, experts said.

Is it O.K. to charge more to that person because they don’t have the resources or time or attention to invest in shopping?

Daniel Schwarcz

“Whether it’s race or gender or sex or health, all of these factors are going to be relevant statistically to questions of how much can you get away with charging,” said Daniel Schwarcz, a professor at University of Minnesota Law School who studies pricing discrimination.

“Let’s say that someone gets cancer and doesn’t have time to shop and just buys the first thing because they have other things to worry about. Is it O.K. to charge more to that person because they don’t have the resources or time or attention to invest in shopping?” he added. “It’s a huge problem that I don’t think society has thought through. We have to ask questions about when we’re O.K. with that and when are we not. And how are we going to police it?”

A 2015 Obama Administration report entitled “Big Data and Differential Pricing” warned of the potential negative effects of personalized pricing becoming widespread—and specifically mentioned insurance: “Differential pricing in insurance markets can raise serious fairness concerns, particularly when major risk factors are outside an individual customer’s control.”

That’s because unlike DVDs, staplers or tutoring, auto insurance isn’t an optional purchase; it’s required by law for drivers in every state except New Hampshire and Virginia. That translates into hundreds of millions of vehicles that must be insured so people can get to work, drive their kids to school, run errands.

Driving without insurance can lead to large fines, license suspension, and even incarceration. With such dire consequences, nearly every state prohibits discriminatory rate-setting, requiring premiums to be “cost-based” or “loss-based,” meaning insurance companies can only price in the risk of a claim and a little overhead.

Allstate’s 2013 proposal didn’t abide by those rules, according to Maryland regulators. The rate proposals for two 42-year-old women living in Baltimore County show how it would have worked.

Allstate determined that they both needed increases of around $1,166 to come in line with risk, records show. One, who was paying $3,610.58 per six months, would have gotten a 20 percent increase, more than $700— which was not as high as the jump the company said she should have gotten based on her risk profile.

That could be considered a win for that customer, until one sees what Allstate proposed for the second woman, who had a much cheaper existing policy of $1,885.32. Rather than the 62 percent increase Allstate reported the second woman needed, she would have seen only a 5 percent increase, or about $90 over six months.

“Allstate is failing to limit rate increases in a manner that treats all insureds with like insuring or risk characteristics equally,” a Maryland insurance regulator at the time, Geoffrey Cabin, wrote in the denial letter in May 2014, specifically calling out the new retention algorithm.

Cabin listed other problems with the rate request and summarized the result: “The filing is disapproved.”

But in emails to The Markup and Consumer Reports, Jones, the Allstate spokesperson, insisted the insurer had withdrawn the filing.

Maryland Insurance Administration spokesperson Joseph Sviatko said Allstate withdrew the filing only after the state emailed the denial letter. Oddly, the filing is labeled “withdrawn” rather than “disapproved” in public records and Sviatko said he couldn’t explain why. He said the designation makes “no practical difference” internally.

He also could not explain why the state’s denial letter was not mentioned or included in the public record—we had to request it twice to get a copy. The first time we were told it didn’t exist.

There is one key difference with the “withdrawn” label on the rate filing: Allstate officials have used it to claim over the past six years to other states’ regulators, investors—and now the media—that its plan had not been rejected. It’s unclear what effect those statements have had.

Consumer advocates have complained for about a decade about auto insurers trying to set personalized rates that move away from risk, using individualized pricing schemes at one point loosely termed “price optimization.”

In 2013, a software developer called Earnix, which sells price optimization products, said its survey of large auto insurance executives in the U.S. and Canada showed that 45 percent were using some form of the technique and another 29 percent were planning to do so. The company did not return calls or emails seeking more information about who those insurers were.

It’s hard to tell whether any particular insurer is using this strategy—even for regulators. It took the work of several statisticians and data journalists at The Markup and Consumer Reports to understand how Allstate’s Maryland proposal set transition prices between the old and new risk models.

“They don’t lie; they just don’t tell you unless you ask the right set of questions,” explained Rich Piazza, the Louisiana Department of Insurance’s chief actuary. “The regulator won’t necessarily know what the insurance company is doing or what goes into their models. Heck, we don’t even know half the models’ names.”

Some don’t ask. New Mexico officials said they had no idea if Allstate was using a retention model in their state in 2016, as the insurer claimed; regulators had approved the rate filing without review, as they normally do.

The National Association of Insurance Commissioners, which includes insurance regulators from all 50 states, said in a report that its members are essentially outgunned: “Regulators do not currently have the data necessary for an independent evaluation of most of the insurer modeling and calculations.”

Allstate executives used to boast about the benefits of price optimization to investors, saying it was leading to growth in its auto insurance line.

“We will utilize pricing sophistication to increase our price competitiveness to a greater share of target customers,” the company wrote in a 2011 filing with the Securities and Exchange Commission. “We call this price optimization and it includes using underwriting information, pricing and discounts” to sell Allstate policies.

During a presentation at the 2013 Sanford Bernstein Strategic Decisions Conference, Allstate CEO Thomas Wilson directly credited the company’s use of “price optimization” as one of the factors improving customer retention.

Then came outside scrutiny.

The nonprofit watchdog Consumer Federation of America released a letter to state insurance regulators in 2014 calling the practice unfair and urging them not to allow it.

“We highly doubt that Allstate is the only company using these illegal techniques,” read the letter, signed by the group’s head of insurance and a former Texas insurance commissioner, J. Robert Hunter, “though we do not know if other insurers are as brazen in their deployment of price optimization as Allstate.”

Allstate responded in a letter to regulators that Hunter’s letter was a bunch of “flawed speculation” and defended its new “21st century” method of transitioning between rates with its algorithm, which it called Complementary Group Rating, or CGR.

“CGR takes what was once an ad hoc, judgmental practice and applies uniform, mathematical rigor to it,” Allstate corporate counsel Maria S. Doughty wrote. “The result is more consistent and certainly less arbitrary.”

The next year a class action lawsuit was filed in California against another insurance company, Farmers Insurance, alleging it was using price optimization to overcharge longtime customers, believing they would be more likely to accept rate increases. Farmers replied that it can’t be sued for rate increases that were approved by the state, court records show. (After years of litigation, Farmers and the class reached a settlement in September, which is pending court approval.)

The practice even stirred controversy within the Allstate community. An anonymous negative article appeared in Exclusive Focus, a magazine published by the National Association of Professional Allstate Agents, independent insurance agents. The writer complained that “the finer the ‘slicing and dicing’” of the customer base by sophisticated algorithms, “the more discriminatory the rating becomes.”

We highly doubt that Allstate is the only company using these illegal techniques.

Consumer Federation of America

Recounting meetings with company management in which agents asked how to explain rate changes to customers, the writer said: “Apparently … agents were warned that ‘those algorithms’ are far too difficult to comprehend or explain to clients.”

In 2014, the regulator group NAIC announced it would publish a white paper on price optimization the following year. In a letter hoping to influence the final paper, the industry trade group Property Casualty Insurers Association of America advocated against new rules, saying that even continuing to talk about it would “demand significant resources from both regulators and companies, incurring costs that consumers and the public will bear to revisit already effective and balanced regulation—all without proven need.”

This was the atmosphere when several states, including Maryland, Florida and Rhode Island, were considering Allstate’s proposals to implement rates with its “retention model.”

Florida regulators told Allstate they intended to reject it, saying in a letter that setting a driver’s premium based on his or her “modeled reaction to rate changes” was “unfairly discriminatory.” Rhode Island regulators raised similar concerns and in both cases, regulators allowed Allstate to withdraw its filing and revert to its prior method for calculating rates.

As regulators scrutinized the new pricing method, Allstate wasn’t always truthful in how it answered their questions. Louisiana regulators asked Allstate whether any other states had rejected the algorithm and retention model, CGR.

In a written response in February 2015, Allstate said: “The new loss model and CGR has not been disapproved in any states,” even though Maryland had by then rejected Allstate’s new loss model and CGR, deeming it discriminatory.

Allstate’s letter instead said the plan had been “withdrawn” in Maryland.

A similar letter to regulators in Ohio in 2016 included Nevada and West Virginia among 23 states in which Allstate said it was using the retention model. But Nevada officials said Allstate never had a retention model in their state “to the best of our knowledge” and West Virginia said they found no record of the Allstate filing containing a retention model.

In an email, Jones, the Allstate spokesperson, said those states’ rating plans did contain retention models, despite what the regulators said. She did not answer questions about whether and how they’d been informed about it.

Piazza, the Louisiana Department of Insurance’s chief actuary, said CGR—at least as Allstate proposed it for his state—was “basically a flavor of price optimization,” and that his office “did not let them use this.” State records show the company withdrew the plan.

“The issue with Allstate wasn’t as much the individual variables as it was that the decision to increase an individual policyholder’s premium was based on the probability of them leaving the company,” he said. “If they were not likely to leave the company, they wanted to charge more. That’s not cost-based.”

It used to be you could look at rate filings in the ’70s and ’80s and you pretty much knew what an insurance company was going to price.

Paul Newsome, Piper Sandler

But when an audience member at the March 2015 Raymond James Institutional Investor Conference asked Allstate officials whether they were worried about the increasing regulatory scrutiny over price optimization, Vice President of Investor Relations Pat Macellaro was not forthcoming about the pushback the company had received from regulators. “I don’t know if it necessarily applies to Allstate,” he said.

A number of states have shut down Allstate’s efforts. Some, like Utah and Colorado, said they made the insurer get rid of the retention models.

In the past five years, at least 18 states and Washington, D.C., have issued public statements prohibiting “price optimization.”

Allstate continues to try to implement its retention models—though it has distanced itself from the term “price optimization.”

When Georgia regulators asked the company last year in a phone call whether its proposed plan used price optimization, records show, officials replied that it did not—saying, among other things, that the term price optimization is too inconsistently defined to say what it is.

Allstate argued regulators should approve the algorithm it was proposing because the variables inside of it comply with state law—which is akin to telling city inspectors that they have to approve a house, no matter how it’s constructed, because all the bricks, wires and pipes would individually be up to code.

Georgia rejected the plan, calling it discriminatory.

Rate filings weren’t always this complex.

“It used to be you could look at rate filings in the ’70s and ’80s and you pretty much knew what an insurance company was going to price,” said Paul Newsome, managing director and senior research analyst at the investment bank Piper Sandler.

In the 1990s, insurers began using external data sources like credit scores to predict accident risk. Since then, rate filings have become increasingly filled with proprietary, opaque algorithms, according to regulators.

Gennady Stolyarov II, a lead actuary at the Nevada Division of Insurance, said all this secrecy and complexity leaves drivers in the dark about how to keep their rates low.

“If a behavior in another sphere of life affects insurance premiums in a way that consumers can’t readily anticipate,” he said in an interview, “that could lead to a cascade of financial consequences arising from what seems to be an innocuous decision.”

Yet regulators play a role in helping insurers keep what they’re doing out of the public eye. Rules vary by state, but insurance companies don’t always submit full details of their pricing algorithms to regulators unless those documents are specifically requested. And insurance companies at times file documents with confidential attachments, blocked from public disclosure due to trade secrets rules.

When we asked Steve Manders, director of insurance product review at the Georgia Department of Insurance, why his state found Allstate’s filing to be discriminatory he refused to be more specific, claiming he was legally obligated to protect that data from competitors and the public.

Patty Born, a professor studying insurance regulation at Florida State University’s College of Business, doubts insurers will ever share enough information about their pricing models to allow customers to know if they’re overpaying. She said the only defense is to regularly check competitors’ rates.

“There are a lot of people who get an auto policy and they stick with that auto insurer forever because the decision is hard in the first place, figuring out what policy you want,” Born said. “Most people just never go back to look to see that they’re paying more than they should.”

Bruce Bennett, a retired hospital administrator from Oklahoma, said he spent more than two decades as an Allstate car insurance customer because he felt the company provided “good service.”

But about a year ago, Bennett, who is 71, said he and his wife reached a breaking point after their premium eclipsed $3,300 for a year of coverage.

“The price increases didn’t really come after any claim. They were just small amounts all during the life of the policy,” said Bennett, who lives in one of the 10 states where public records show Allstate uses a retention model.

He shopped around and Safeco, a subsidiary of Liberty Mutual, offered to cut Bennett’s premium by nearly half—a reduction of more than $1,400 a year. He jumped at it.

“Insurance premiums were not really much of an imposition to us” when he was working, he said. “We just plodded along seeing no pressing need to switch companies.

“But now that my income is no longer six digits, we seem to notice our expenses a bit more; hence the interest in making a change,” he added. “I think the frog-in-boiling-water scenario finally got to us this year.”