State of Texas v. Arity 875, LLC

ACCEPTED 15-25-00082-CV No. 15-25-00082-CV FIFTEENTH COURT OF APPEALS AUSTIN, TEXAS In the Court of Appeals 9/15/2025 3:46 PM CHRISTOPHER A. PRINE

for the Fifteenth Judicial District FILED IN CLERK

Austin, Texas 15th COURT OF APPEALS AUSTIN, TEXAS 9/15/2025 3:46:35 PM CHRISTOPHER A. PRINE State of Texas, Clerk Appellant, v. Arity 875, LLC, Appellee.

On Appeal from the 457th Judicial District Court, Montgomery County

APPELLANT’S REPLY BRIEF

Ken Paxton Rick Berlin Attorney General of Texas Assistant Attorney General State Bar No. 24055161 Brent Webster Rick.Berlin@oag.texas.gov First Assistant Attorney General Office of the Attorney General Ralph Molina Consumer Protection Division Deputy First Assistant Attorney General 808 Travis Street Suite 1520 Houston, Texas 75251 Austin Kinghorn Tel: (800) 621-0508 Deputy Attorney General for Civil Litigation

Johnathan Stone Chief, Consumer Protection Division Counsel for Appellant

ORAL ARGUMENT REQUESTED

IDENTITY OF PARTIES AND COUNSEL Appellant: Appellate and Trial Counsel:

State of Texas Rick Berlin Assistant Attorney General State Bar No. 24055161 Rick.Berlin@oag.texas.gov

Kaylie Buettner Assistant Attorney General State Bar No. 24109082 Kaylie.Buettner@oag.texas.gov

Richard McCutcheon Assistant Attorney General State Bar No. 24139547 Richard.McCutcheon@oag.texas.gov

Office of the Attorney General of Texas Consumer Protection Division 808 Travis St., Suite 1520 Houston, Texas 77002

Appellee: Appellate and Trial Counsel:

Arity 875, LLC W. Reid Wittliff State Bar No. 00791951 WITTLIFF CUTTER PLLC 510 Baylor St. Austin, Texas 78703 Telephone: (512) 960-4866 Facsimile: (512) 960-4869 Email: reid@wittliffcutter.com

Jake Sommer Kelsey Harclerode ZWILLGEN PLLC 1900 M Street NW, Suite 250 Washington, D.C. 20036 Telephone: (202) 296-3585 Email: jake@zwillgen.com kelsey@zwillgen.com

Sudhir V. Rao ZWILLGEN PLLC 183 Madison Ave., Suite 1504 New York, NY 10016 Telephone: (646) 362-5590 Email: sudhir.rao@zwillgen.com

TABLE OF CONTENTS IDENTITY OF PARTIES AND COUNSEL ......................................................... 2 INDEX OF AUTHORITIES .................................................................................. 5 INTRODUCTION.................................................................................................. 8 ARGUMENT .......................................................................................................... 9 I. VOLKSWAGEN CONTROLS. .......................................................................... 9 A. Arity 875’s Data Collection Creates Minimum Contacts with Texas under Volkswagen. .................................................................... 10 B. Arity 875’s “Distributor Intermediary” Relationship with the App Developers Creates Minimum Contacts under Volkswagen. ......................................................................................... 11 II. ARITY 875’S ARGUMENTS CONCERNING ITS DATA COLLECTION LACK MERIT. ............................................................................................ 12 A. Data Collection without Consent Is Not an “Out-Of-State Omission.” ......................................................................................... 13 B. Arity 875, not the App Developers or Users, Decides Whether It Collects Data. ...................................................................16 III. ARITY 875 CANNOT DISTINGUISH ITS ACTIONS FROM VOLKSWAGEN. .......................................................................................... 20 A. Volkswagen’s “Stream of Commerce” Framework Applies. ............ 21 B. Arity 875’s Conduct Fits Volkswagen’s “Stream of Commerce” Framework. ................................................................... 22 IV. ARITY 875 MISAPPLIES GOOGLE. ............................................................... 23 V. ARITY 875’S REMAINING ARGUMENTS ARE MISCELLANEOUS DISTRACTIONS. ......................................................................................... 28 PRAYER ................................................................................................................. 31 CERTIFICATE OF COMPLIANCE..................................................................... 31

INDEX OF AUTHORITIES

CASES

Alves v. Goodyear Tire & Rubber Co., 683 F. Supp. 3d 111 (D. Mass. 2023), appeal dismissed, No. 23-1682, 2023 WL

9782813 (1st Cir. Dec. 18, 2023) ........................................................................ 30 Anderson v. Bechtle,

No. 01-00-00593-CV, 2001 WL 930205 (Tex. App.—Houston [1st Dist.] 2001,

no pet.) ............................................................................................................... 16 Brocail v. Anderson,

132 S.W.3d 552 (Tex. App.—Houston [14th Dist.] 2004, pet. denied) ............. 16

BRP-Rotax GmbH & Co. KG v. Shaik, 716 S.W.3d 98 (Tex. 2025) .......................................................................... passim

Chen & DynaColor, Inc. v. Razberi Techs., Inc., No. 05-19-01551-CV, 2022 WL 16757346 (Tex. App.—Dallas Nov. 8, 2022, pet. denied) .......................................................................................................... 14, 15 Dalal v. Clearview AI, Inc.,

No. CV 24-10380-SDW-AME, 2025 WL 1726259 (D.N.J. May 1, 2025), report and recommendation adopted, No. CV 24-10380 (SDW) (AME), 2025 WL

1725010 (D.N.J. June 20, 2025) ......................................................................... 29 Hindujab Glob. Sol., Inc. v. Ganjaei, No. 05-22-00052-CV, 2023 WL 179808 (Tex. App—Dallas Jan. 13, 2023, pet. denied) ............................................................................................................... 14 *6 Jackson v. Hoffman, 312 S.W.3d 146 (Tex. App.—Houston [14th Dist.] 2010, no pet.) .............. 25, 26 Johnson v. TheHuffingtonPost.com, Inc., 21 F.4th 314 (5th Cir. 2021) ............................................................................... 19 Luciano v. SprayFoamPolymers.com, LLC, 625 S.W.3d 1 (Tex. 2021) ...................................................................11, 21, 22, 23 McDonald v. Kiloo ApS, 385 F. Supp.3d 1022 (N.D. Cal. 2019) ......................................................... 28, 29 Mehta v. State ex rel. Ahmed,

716 S.W.3d 186 (Tex. App. [15th Dist.] 2025) .............................................. 15, 16 Moncrief Oil Int’l Inc. v. OAO Gazprom,

414 S.W.3d 142 (Tex. 2013) ............................................................................... 25

Slyce Acquisition Inc. v. Syte – Visual Conception Ltd., 422 F.Supp.3d 1191 (W.D. Tex. 2019) ................................................................17

State v. Volkswagen Aktiengesellschaft, 669 S.W.3d 399 (Tex. 2023)........................................................................ passim

STATUTES

Tex. Bus. & Com. Code § 509.005 .........................................................................13 Tex. Bus. & Com. Code § 541.101(b)(3) .................................................................13 Tex. Bus. & Com. Code § 541.102 ..........................................................................15 Tex. Bus. & Com. Code § 541.103 ..........................................................................15 Tex. Bus. & Com. Code §§ 541.101(a)–(b) .............................................................15 *7 Tex. Civ. Prac. & Rem. Code § 17.042(2) .............................................................. 24 Tex. Civ. Prac. & Rem. Code § 17.042(1) .............................................................. 24 Tex. Ins. Code § 541.001.........................................................................................13

INTRODUCTION

On a basic level, Arity 875 asks this Court to permit it to collect sensitive data directly from millions of Texans’ phones but not be subject to Texas’ jurisdiction because it collects the data through third-party apps. No court approves this understanding of personal jurisdiction, and the Texas Supreme Court expressly rejected it in Volkswagen. Arity 875 tries to avoid that simple conclusion with a lengthy argument composed of meaningless distinctions and distractions. Arity 875’s sidestepping of the State’s core allegations and reinvention of the State’s case reveal its fundamental inability to square its conduct with the law. When viewed against binding precedent, undisputed facts, and well-established principles of personal jurisdiction, Arity 875’s arguments fall short.

Arity 875 does not dispute the relevant evidence. First, Arity 875 continuously collects data from Texas devices. Arity Br. 5; Am. C.R. at 58, 68, 82 ¶ 9; State Br. 13–14. Second, its contracts require Texas companies to install software that captures driving behavior data–the Arity software development kit (“Arity SDK”)– in their mobile apps, which Arity 875 then uses to collect data from Texas devices. Arity Br. 7, 17; Am. C.R. at 216–17 ¶¶ 38–41; State Br. 14–16. Finally, Arity 875 purchases information concerning Texas individuals from Texas-based companies, Arity Br. 52 (acknowledging receipt of Texans’ personal identifying data through *9 licensing); Am. C.R. at 217 ¶ 42; State Br. 15. Further, Arity 875 itself admits that it provides “services” to Texas, notwithstanding attempts to obscure what such “services” are and whether they are “relevant.” See Arity Br. 4, 40; Am. C.R. at 82 ¶ 9; State Br. 13–14. All these Texas contacts substantially relate to the State’s claims.

The Court need not reinvent the wheel here. Although this is a complex, multi-party case concerning sophisticated technology, whether Arity 875 should be subject to personal jurisdiction remains simple. Because the State alleges Arity 875 violated Texas law by unlawfully collecting and processing Texans’ data from Texas devices, Texas courts should hear Texas’ claims.

ARGUMENT

I. VOLKSWAGEN CONTROLS.

Volkswagen requires finding for the State. See State v. Volkswagen Aktiengesellschaft, 669 S.W.3d 399 (Tex. 2023). The State explained in its brief that Arity 875’s conduct falls within Volkswagen’s scope in at least two ways, each independently sufficient for this Court to exercise jurisdiction. First, Arity 875’s data collection in Texas using the Arity SDK directly creates minimum contacts with Texas. Second, Arity 875 established a distribution chain that guaranteed that its software would land in Texas. Similar to the software updates in Volkswagen, Arity *10 875 creates Texas contacts through a “distributor-intermediary” relationship with the app developers. See id. at 432.

A. Arity 875’s Data Collection Creates Minimum Contacts with Texas under Volkswagen.

Thousands of times every day, Arity 875 reaches into the phones of Texans and takes data that tracks their movements in Texas. The fact that they do this to citizens in every state does not make their Texas conduct any less egregious, invasive, or worthy of judicial review. Arity 875 does not dispute that it collects data from Texas phones using the Arity SDK as part of a nationwide scheme. See, e.g., Am. C.R. at 67 (“[T]he challenged data collection affected Texans in the same way it did residents of all other states[.]”), 82 (“[T]he challenged data collection occurred nationally.”). That admission shows Arity 875 made the decision to collect data from Texas phones and create Texas contacts. Am. C.R. at 206 ¶ 2, 214 ¶ 31 (Arity maintains three million connections with Texas). But Arity 875’s intentional targeting of Texans doesn’t end there: Arity 875 also highlights Texas data on its website for marketing purposes. Am. C.R. at 219 ¶ 44.

By choosing to collect data from Texas devices, Arity 875 “purposefully availed itself to the privilege of conducting activities in Texas.” See Volkswagen, 669 S.W.3d at 413 (internal citation omitted). Arity 875 is not insulated from personal jurisdiction “merely because the defendant has targeted other states in a similar *11 manner.” See id. at 421; compare Volkswagen, 669 S.W.3d at 420 (rejecting the idea that “a nonresident who has directed activity to every state is not amenable to jurisdiction in any state”), with Am. C.R. at 82 (“[Arity 875’s] services are equally available in Texas as they are in all other States.”). The collection relates to the State’s claims because all the State’s claims against Arity 875 stem from Arity 875’s collection of data from the Arity SDK. See Volkswagen, 669 S.W.3d at 430 (requiring an “affiliation” between the forum and underlying controversy); State Br. 41–44 (explaining “affiliation” prong). Arity 875 created Texas contacts by directly interfacing with Texas devices and specifically marketing its Texas data to customers.

B. Arity 875’s “Distributor Intermediary” Relationship with the App Developers Creates Minimum Contacts under Volkswagen.

Arity 875 also exerts control over the third-party apps to implement the Arity SDK the same way Volkswagen exerted control over its dealerships to implement its software updates. Acting through a “distributor-intermediary” to intentionally target Texas as a marketplace “provides no haven from the jurisdiction of a Texas court.” Volkswagen, 669 S.W.3d at 418 (quoting Luciano v. SprayFoamPolymers.com, LLC, 625 S.W.3d 1, 12 (Tex. 2021)). Just like in Volkswagen, Arity 875 has a “contractual relationship the parties designed with regard to the specific mechanism by which the wrongful conduct occurred in Texas.” Id. at 419.

In Volkswagen, the contractual relationship came from Volkswagen Germany’s subsidiary dealerships, which were used as “passthrough departments” to initiate Volkswagen Germany’s software updates. Id. at 418. Here, Arity 875 contracted with mobile app developers acting as “a mere conduit” to install the Arity SDK on mobile devices on the “behalf of and at the initiation of” Arity 875. See id. at 415; Am. C.R. at 207 ¶ 5, 216–17 ¶¶ 38–41.

Given Volkswagen and Arity 875’s near-identical contractual arrangements with third parties, the Court should hold Arity 875 used the third-party apps as a “distributor-intermediary” to target Texas consumers.

II. ARITY 875’S ARGUMENTS CONCERNING ITS DATA COLLECTION LACK MERIT.

Nonetheless, Arity 875 offers a litany of excuses as to why the Court should not consider its conscious decision to collect data from, and maintain continuous connections with, nearly three million Texas individuals’ phones to constitute sufficient Texas contacts. None have merit. Arity 875’s workarounds take two general forms: (1) recharacterizing its collection without consent as an “omission” rather than an affirmative act that creates a Texas contact, and (2) shunting responsibility for where it collects data to the apps and its users. But Arity 875, not the app developers or their users, makes the deliberate, affirmative decision to reach into Texas to collect Texans’ data. That fact controls.

A. Data Collection without Consent Is Not an “Out-Of-State Omission.”

All agree that Arity 875 collects data from Texans’ mobile phones and purchases Texas data. The core controversy is whether Arity 875 had the legal right to perform those acts without obtaining consent, posting adequate disclosures, or registering as a data broker in Texas. Arity 875 claims its collection of data without permission is an “out-of-state omission,” reasoning that, because Texas law does not prohibit data collection, with appropriate consent, the only acts that could relate to the State’s claims are its “failure to provide the required information or obtain the required consent” or “failure to register.” Arity Br. 43, 51, 53–54. From there, Arity 875 asserts that collection of Texas data does not relate to the State’s claims in this lawsuit about illicit data collection. But Arity 875’s actions and inactions are inextricably linked together.

Arity 875’s collection of data creates the Texas contacts, and that collection without consent renders its conduct illegal. See, e.g., Tex. Bus. & Com. Code § 541.101(b)(3) (imposing a duty on a data controller to not process sensitive data without consent); Tex. Bus. & Com. Code § 509.005 (requiring registration when conducting business in the State of Texas); Tex. Ins. Code § 541.001 (imposing liability for unfair acts in the business of insurance stemming from unfair data collection practices). Arity 875’s response distracts from the core inquiry by focusing *14 on the “consent” and “disclosure” requirements without addressing Arity 875’s underlying actions. See Arity Br. 43. Arity 875’s argument does not meaningfully counter or negate the idea that collecting data from Texas creates Texas contacts.

Instead, Arity 875 cherry-picks a series of quotes from unrelated cases. For example, Arity 875 leads with the Fifth Court of Appeals’ non-binding statement that “failure to disclose cannot be purposeful availment.” Hindujab Glob. Sol., Inc. v. Ganjaei, No. 05-22-00052-CV, 2023 WL 179808, at *6 (Tex. App—Dallas Jan. 13, 2023, pet. denied). But Ganjaei involved an out-of-state defendant that allegedly failed to disclose that he possessed a conflict of interest adverse to a Nevada company that was based in Texas. Id. at *1, *6. He had no connection with Texas, unlike the millions of connections Arity 875 purposefully created here.

Similarly, Arity 875 references another Fifth Court of Appeals case denying personal jurisdiction over a Taiwan-based defendant for claims of an alleged failure to disclose a conflict of interest to third-party investors. See Chen & DynaColor, Inc. v. Razberi Techs., Inc., No. 05-19-01551-CV, 2022 WL 16757346, at *8 (Tex. App.— Dallas Nov. 8, 2022, pet. denied). There, the court relied not on the location but the fact that the defendant had no duty to disclose the alleged conflict. See id. (“Thus, without more, such as a specific duty to disclose, we cannot conclude that appellants’ conduct of sitting mute in Taiwan constitutes directing a tort at Texas or arises from *15 or relates to their contacts with Texas.”) (emphasis added). Outside the fact that Arity 875 collects Texas data from Texas devices, Arity 875 has a specific duty to disclose under the TDPSA. Tex. Bus. & Com. Code §§ 541.101(a)–(b) (requiring limitation of data processing based on what was disclosed and informed consent before collection of sensitive data), 541.102 (requiring privacy notice disclosing privacy practices), 541.103 (requiring conspicuous disclosure of targeted advertising process and opt-out option). Arity 875 omits the unfavorable “without more” language from its version of the quote in its brief, which the Chen court intimates would change the analysis. Compare Chen, 2022 WL 16757346, at *8, with Arity Br. at 42.

Arity 875 also references Mehta v. State ex rel. Ahmed, where this Court rejected personal jurisdiction where a non-resident, who made drug manufacturing decisions in New Jersey, entered into a marketing agreement with Pfizer, who later sold the drug in Texas. 716 S.W.3d 186, 190 (Tex. App. [15th Dist.] 2025). Arity 875’s reliance on Mehta misconstrues the nature of the relationship Arity 875 has with the mobile apps. See Arity Br. 42. Mehta’s “decisions about drug manufacturing outside of Texas [were] not contacts with Texas,” particularly where Pfizer sold the drug without Mehta’s involvement. See Mehta, 716 S.W.3d at 190. Arity 875 claims that its actions are like Mehta’s, who made the decision about drug *16 manufacturing from afar in New Jersey and that the apps are Pfizer, responsible for distribution without Mehta’s input. See id. But unlike in Mehta, the undisputed facts show that Arity 875 itself connects to Texans’ devices, collects their data through the Arity SDK, and uses the third-party apps as the vessels for that connection. The two cases are factually and fundamentally distinguishable.

Arity 875’s remaining authorities are likewise factually distinct. See, e.g., Brocail v. Anderson, 132 S.W.3d 552, 564 (Tex. App.—Houston [14th Dist.] 2004, pet. denied) (rejecting personal jurisdiction for a medical negligence, fraud, and fraudulent concealment for doctor who performed surgery and prescription plans in Michigan); Anderson v. Bechtle, No. 01-00-00593-CV, 2001 WL 930205, at *2 (Tex. App.—Houston [1st Dist.] 2001, no pet.) (rejecting personal jurisdiction for non-resident individual corporate officers and directors alleged misrepresentations with no Texas contacts and no duty to disclose). Unlike these cases, Arity 875 performs data collection in Texas.

B. Arity 875, not the App Developers or Users, Decides Whether It Collects Data.

Arity 875 attempts to further muddy the waters by casting its deliberate decision to collect data in Texas as one made by the third-party mobile apps and Texas consumers. Arity 875 claims that, because it does not maintain complete control over the apps’ data collection requirements, its contacts with Texas are *17 either “random and fortuitous” or result from “nonparties’ unilateral conduct.” See Arity Br. 3, 27. This fails many times over.

First, Arity 875 retains ultimate control over whether Arity 875 collects data in Texas. Arity 875 deliberately developed a system to collect data from individual phones. If Arity 875 did not want to collect data from or create a continuous connection with Texas phones, it could decide not to do so. It is certainly within their power not to maintain three million connections with individual phones in Texas. Am. C.R. at 206 ¶ 2, 214 ¶ 31. These Texas contacts cannot be chalked up to “random contacts” or the “unilateral activity of another party,” because Arity 875 created a structured plan for who, what, when, where, and how it would collect data. The discretion to collect data from Texas lies with Arity 875, not any other party.

Second, Arity 875 contracted with third-party mobile apps to integrate the Arity SDK into their apps to exploit these apps’ existing userbases. See Volkswagen, 669 S.W.3d at 422 (“[T]heir contacts reflect both an expectation that the software updates would be deployed in Texas and a clear choice to enter the Texas market where a substantial number of targeted vehicles would be serviced.”); see also Slyce Acquisition Inc. v. Syte – Visual Conception Ltd., 422 F.Supp.3d 1191, 1201 (W.D. Tex. 2019) (upholding personal jurisdiction based on distribution of apps through iTunes *18 and Google Play servers). Here, Arity 875 had an expectation that its software would be deployed in Texas and made a clear choice to enter the Texas market.

Arity 875 argues that because the mobile apps “license” the Arity SDK from Arity 875, responsibility falls on the apps. See, e.g., Arity Br. 38–39. But Arity 875 pays the apps to “license” the Arity SDK and gain access to the apps’ data. Am. C.R. at 207, ¶ 5 (“Defendants paid app developers millions of dollars to integrate Defendants’ software into their apps”). The Arity SDK’s presence on Texas mobile devices are not the “unilateral acts” of the third-party mobile apps or “random or fortuitous,” but instead the result of Arity 875 directing the mobile apps to undertake collection on its behalf.

Third, and consistent with this arrangement, the fact that Arity 875 requires certain inputs from the end user to enable data collection does not change the outcome. Once those criteria are met, the Arity SDK turns on automatically, and Arity 875 reaches into Texas to collect data from Texas phones. Arity 875 determines what conditions are necessary for the Arity SDK to switch on and thereby determines when it wants to contact Texas. See, e.g., Am. C.R. at 58 (requiring mobile apps to warrant the data was lawfully collected), 216 ¶ 39 (noting a user enabling location features permits the Arity SDK to function, undetected). These are not “random and fortuitous” contacts “beyond Arity 875’s control” but rather *19 a clear set of conditions that allow Arity 875 to purposefully choose when it wants to collect data. Contra Arity Br. 27.

Finally, the apps that embed the Arity SDK are not akin to a “universally accessible website,” nor is the Arity SDK itself. Contra Arity Br. 29. Unlike a website which passively exists, and a user can visit and leave at his or her discretion, Arity 875 reaches into Texans’ phones every fifteen seconds to collect data so long as an app with the Arity SDK is installed. Further, the apps and the Arity SDK do not operate like mere “passive” websites but instead provide specific services to end-users, some of which are powered by the Arity SDK. See BRP-Rotax GmbH & Co. KG v. Shaik, 716 S.W.3d 98, 109 (Tex. 2025) (noting distinction between “passive” and “active” websites for personal jurisdiction purposes). Outside of the continuous data collection, the Arity SDK receives, processes, and sends user data concerning events such as crash detection. Am. C.R. at 90, ¶ 8–9; Arity Br. 6.

Even if Arity 875’s comparison had merit, the standard that applies to “interactive” websites would still establish minimum contacts because Arity 875 targets Texas because it both sends and receives information. See, e.g., Johnson v. TheHuffingtonPost.com, Inc., 21 F.4th 314, 318 (5th Cir. 2021) (“[I]f the site interacts with its visitors, sending and receiving information from them, we must then apply our *20 usual tests to determine [whether plaintiff’s suit] arise[s] from the defendant’s purposeful targeting of the forum state.”) (emphasis added).

III. ARITY 875 CANNOT DISTINGUISH ITS ACTIONS FROM VOLKSWAGEN.

Arity 875 has the same type of Texas contacts as Volkswagen yet in greater quantity. The software updates in Volkswagen were implemented through third-party intermediaries in discreet nationwide updates with no direct contact to Texas consumers. Volkswagen, 669 S.W.3d at 410–11. Here, Arity 875 uses the third-party apps as the medium for an active, continuous connection directly with Texas devices and as a distribution channel to target Texas consumers. That is more than enough under the Volkswagen framework.

Arity 875 raises five points against this conclusion. First, Arity 875 states Volkswagen’s “stream of commerce” framework applies only to “products-liability cases.” Arity Br. 35. Second, Arity 875 claims Volkswagen Germany had “unique and pervasive control” over the distribution of its software. Id. at 37. Third, Arity 875 claims the circumstances of when and where the Arity SDK collects data happen—at least in part—outside Arity 875’s direct control, which is not relevant because Arity 875 dictates the terms for when it collects data. Id. at 38–39. Fourth, Arity 875 argues that the Arity SDK’s existence itself does not violate Texas law. Id. *21 at 39. Fifth, Arity 875 claims it does not have relevant Texas contacts. Id. at 39–40. None have merit and only the first two warrant discussion.

A. Volkswagen’s “Stream of Commerce” Framework Applies.

Arity 875 argues that Volkswagen applies “stream-of-commerce-plus,” which only applies to products-liability cases, while simultaneously noting Volkswagen is not even a “stream-of-commerce case.” Arity Br. 35; Shaik, 716 S.W.3d at 110 (noting Volkswagen was not a “stream-of-commerce” case). The latter view is correct.

Volkswagen itself was not a products-liability case, so the argument that Volkswagen’s rule applies only to products-liability cases must fail. See 669 S.W.3d at 410–11 (noting the State filed an environmental enforcement action). Arity 875 correctly notes that Volkswagen analogized the stream-of-commerce-plus theory. Arity Br. 36. And that is what the State asks this Court to do with respect to Arity 875’s Texas contacts arising from its distribution of the Arity SDK. State Br. 31–32.

Arity 875 misreads an offhand remark by the Texas Supreme Court concerning Luciano in BRP-Rotax GmbH & Co. v. Shaik to avoid Volkswagen’s reach. 716 S.W.3d at 105 (noting that “in certain products liability cases,” plaintiffs “may leverage the stream-of-commerce plus test”) (citing Luciano, 625 S.W.3d at 9). Arity claims Shaik imposes a restriction on the Volkswagen rule to limit the application of *22 Volkswagen’s “stream-of-commerce” theory to only products-liability cases. Arity Br. 35.

Shaik provides no obstacle to using Volkswagen here. First, the Court does not cite Volkswagen or even express a mechanical rule that “stream-of-commerce plus” applies only in products-liability cases. See Shaik, 716 S.W.3d at 105. The Court merely notes that “in certain products liability cases,” the “stream of commerce test” may be used. Id. Second, even assuming Arity 875’s read of Shaik was correct, the State urges the same “stream-of-commerce” analogy from Volkswagen, not the “stream-of-commerce plus” test from Luciano. Finally, Shaik explicitly provides that a “sovereign prosecuting [a case] for purposefully violating Texas law inside Texas” provides unique considerations that trigger the application of Volkswagen. Id. at 110. Arity 875’s contorted reading of Shaik does not change Volkswagen’s on-point holding.

B. Arity 875’s Conduct Fits Volkswagen’s “Stream of Commerce” Framework.

Arity 875 claims that Volkswagen could not apply to its conduct because unlike Volkswagen, Arity 875 does not have “unique and pervasive” control that forces the third-party apps to install the Arity SDK. Arity Br. 37. First and foremost, Arity 875 does contractually obligate the apps to install the Arity SDK, just like how Volkswagen Germany obligated its subsidiaries to roll-out software updates. Second, *23 the phrase “unique and pervasive” does not appear anywhere in Volkswagen. The Court never indicated that the specific level of control Volkswagen Germany had over its subsidiaries would be required to find jurisdiction and such a constrictive reading should be rejected.

Rather, the Court indicated that the touchstone for finding personal jurisdiction comes from the standard established in Luciano. Volkswagen, 669 S.W.3d at 418. Volkswagen indicates that “acting through a distributor-intermediary” to intentionally target Texas creates jurisdictional contacts. Id. Much like how Volkswagen Germany “directly and purposefully” targeted cars in Texas using its subsidiaries, Arity 875 did the same for Texas mobile devices using the third-party apps. See Shaik, 716 S.W.3d at 110 (analyzing Volkswagen, 669 S.W.3d at 415, 417, 420). In this respect, the third-party apps were the mere instrumentalities of Arity 875’s illegal acts, much like the dealerships in Volkswagen.

Because Arity 875’s conduct implicates the same “stream-of-commerce” analogy as Volkswagen, this Court should find personal jurisdiction here for the same reasons.

IV. ARITY 875 MISAPPLIES GOOGLE.

Arity 875 misconstrues the applicability of Google LLC v. The State of Texas. In Google, the Court found that there was no activity that occurred within Texas *24 related to the State’s claims and all tortious conduct occurred outside of the state. Google LLC v. State, No. 13-23-00114-CV, 2025 WL 52611 (Tex. App.—Corpus Christi–Edinburg Jan. 9, 2025, pet. abated). Here, the State’s claims relate not only to tortious conduct that took place in Texas but also contracts with Texas entities that were performed in Texas. Arity 875 misstates that the State’s claims only look at Arity 875’s policy disclosures and consent statements, completely ignoring their contracts with third-party mobile apps, vehicle manufacturers, and the collection of data from mobile devices within Texas.

The Texas long-arm statute states that a nonresident does business in the state if they contract with a Texas resident and either party completes all or part of the contract in the state or if they commit a tort “in whole or in part” in Texas. Tex. Civ. Prac. & Rem. Code §§ 17.042(1) & (2). In Google, the State alleged that Google violated the Texas Deceptive Trades Practices—Consumer Protection Act (DTPA) because of their private-browsing activity and location tracking policies. 2025 WL 52611 at *6. There, the Court held that the State did not “…[meet] its initial burden to show that appellant’s allegedly tortious conduct occurring outside of Texas is sufficient to confer specific jurisdiction.” Id. at *7. The Court reasoned that Google’s alleged tortious conduct occurred wholly outside of Texas and “[a] nonresident directing a tort at Texas from afar is insufficient to confer specific *25 jurisdiction.” Id. (quoting Moncrief Oil Int’l Inc. v. OAO Gazprom, 414 S.W.3d 142, 157 (Tex. 2013)). Here, Arity 875 erroneously states that “…the State’s allegations and jurisdictional theories [in Google] are virtually identical to those here,” when they are not. Arity Br. 46.

The facts underlying the State’s claims in this case raise a stark contrast to those in Google. Not only does Arity 875 collect and sell Texans’ data, but they have also contracted with vehicle manufacturers and third-party mobile apps to collect Texas consumers’ personal data. See Am. C.R. at 214, 216–217, 227, and 230 (Am. Pet. ¶¶ 31, 38, 40–42, 74, 88, and 90). Specific jurisdiction does not exist if a contract is performed wholly outside of Texas. Jackson v. Hoffman, 312 S.W.3d 146, 154 (Tex. App.—Houston [14th Dist.] 2010, no pet.) (holding there was no jurisdiction over a Missouri auto repair shop who performed restoration services in the Missouri shop on a vehicle located in Missouri, even if the vehicle’s owner resided in Texas). In Google, the operative facts dealt solely with the terms of service and disclosures, which had no nexus to Texas, so all relevant events were outside of Texas. 2025 WL 52611 at *7. Arity 875 mistakenly asserts that the State’s claims here mirror those made in Google, because the operative facts forming the basis of the claims there “concerned Google’s allegedly misleading statements,” and “[n]either the *26 allegations nor evidence established” that Google employees within Texas made the misleading statements. Arity Br. 48.

That is not the fact pattern in this case. Instead, Arity 875 contracted with third-party mobile app companies, such as GasBuddy and Fuel Rewards, to integrate the Arity SDK into their apps, which collected the data from the app user. Am. C.R. at 216–17 (Am. Pet. ¶¶ 38–42). GasBuddy and Fuel Rewards have headquarters in Dallas, Texas. Am. C.R. at 216 (Am. Pet. ¶ 38). Part of these agreements with the app companies provided that “Defendants owned any Arity SDK Data they collected from an app user and were permitted to use the Arity SDK Data for their own independent purposes.” Am. C.R. at 217 (Am. Pet. ¶ 41). So, Arity 875 contracted with Texas entities and those contracts were performed in Texas. Additionally, Arity 875 contracted directly with vehicle manufactures to “receive and access Texans’ driving data.” Am. C.R. at 230 (Am. Pet. ¶ 90). Unlike Google and Jackson where all the conduct occurred outside of Texas, the collection of consumers’ data occurred in Texas pursuant to licensing agreements with Texas entities.

Arity 875 contends that the State’s claims merely arise from “alleged omissions that occurred, if at all, outside of Texas.” Arity Br. 9. Namely, “the failure to disclose information to consumers, obtain consumer consent… and register as a *27 data broker in Texas,” completely ignoring the conduct taking place within Texas. Arity Br. 11. Arity 875 argues that the “challenged disclosure and consent policies are not substantially connected to Texas,” and all decision-making regarding policies at issue occur outside of Texas, and the teams involved in developing and licensing the SDK are also outside of Texas. Arity Br. 44–45. However, contrary to Arity 875’s insistence, “this is not a ‘directed-a-tort’ case.” State Br. 43. Courts “review the substantial connection between the operative facts of the litigation based on the claims involved in the litigation and the defendant’s contacts with Texas.” 2025 WL 52611 at *2. Arity 875 attempts to assert that the State failed to allege that “Arity 875 negotiated or entered contracts with either entity in Texas,” that the apps “had Texas users,” that the “contracts were to be performed in Texas,” among others. Arity Br. 7–8. But the State’s allegations make it clear that Arity 875 has entered into licensing agreements with Texas entities, see Am. C.R. at 216–217, 226–227, and 230 (Am. Pet. ¶¶ 38, 40–41, 72, 74, and 88), and that “Arity 875 has committed torts within Texas.” State Br. 44.

Arity 875 woefully misreads and misapplies Google both in fact and law. Here, the contacts, including contracts entered into with vehicle manufacturers and third-party mobile app developers, are the acts of Arity 875 in Texas and this court should find that personal jurisdiction exists.

V. ARITY 875’S REMAINING ARGUMENTS ARE MISCELLANEOUS DISTRACTIONS.

Arity 875 makes feeble attempts to distract from the relevant issues at play. First, Arity 875 asserts that their contacts with Texas are simply related to Texans that “happened to download and use apps that incorporated the Arity SDK” and mobile app developers that licensed the Arity SDK. Arity Br. 25–26. Arity 875 tries to assert that only after developers and mobile app users “have made several unilateral choices does the Arity SDK collect data.” Arity Br. 27. Arity 875’s argument misses the mark. As described supra, Arity 875 entered into licensing agreements with third-party mobile apps. Arity 875 maintained ownership of the data collected via those apps, so their contacts with Texas are not passive.

Second, Arity 875’s argument regarding the foreseeability of harm falls flat. Arity 875 throws out a slew of irrelevant case law regarding “universally accessible websites.” Arity Br. 29. For example, Arity 875 incorrectly asserts that the State is basing its jurisdictional premise simply on the fact that they knew mobile apps would have Texas users, Arity Br. 28, and argues that a California court in McDonald v. Kiloo ApS (denying a finding of jurisdiction over an SDK developer) is informative. McDonald v. Kiloo ApS, 385 F. Supp.3d 1022, 1041 (N.D. Cal. 2019). In McDonald, the plaintiff was “not suing for any breaches of [the] contract,” and therefore the Court found there was no nexus to the operative facts. Id. at 1042. Arity 875 *29 emphasizes that the “State does not purport to challenge the contracts themselves” either, so the conclusion should be similar to that in McDonald. Arity Br. at 49. However, in McDonald, the basis of jurisdiction was premised only on the fact that the defendant was aware the apps would appear on California devices and not on the defendant’s actions within California. Id. at 1041–1042. Unlike the defendant in McDonald, Arity 875’s contacts with Texas go well beyond the foreseeability of harm argument Defendant attempts to assert.

Another distinguishable case cited by Arity 875, Dalal v. Clearview AI, Inc., also undercuts Arity 875’s argument. In Dalal, the plaintiff “fail[ed] to point to any allegation indicating that Clearview forged purposeful affiliations” with the forum in relation to his claims. Dalal v. Clearview AI, Inc., No. CV 24-10380-SDW-AME, 2025 WL 1726259, at *9 (D.N.J. May 1, 2025), report and recommendation adopted, No. CV 24-10380 (SDW) (AME), 2025 WL 1725010 (D.N.J. June 20, 2025). The claims in Dalal arose from the “alleged sale of access to the unlawfully obtained biometric data to businesses,” but there was “no indication that Clearview sold access” to that data. Id. at *8. Here, Arity 875’s agreements with the app developers permitted them to use and sell the data collected from the apps, which they did.

The remainder of the cases cited also involve companies with websites visible in the forum state with no other substantiated contacts. See Alves v. Goodyear Tire & *30 Rubber Co., 683 F. Supp. 3d 111, 119 (D. Mass. 2023), appeal dismissed, No. 23-1682, 2023 WL 9782813 (1st Cir. Dec. 18, 2023) (holding that no personal jurisdiction exists when the “intentional contact” is the accessibility of a “generally accessible website); Shaik, 2025 WL 1727903, at *2, *7 (holding no specific personal jurisdiction for a foreign aircraft engine designer and manufacturer with indirect Texas contacts when the plaintiffs did not “identif[y] anything about the website that targets Texas or Texans…”). Arity 875 attempts to show that these cases are relevant because universally accessible apps are parallel to universally accessible websites and are therefore not subject to jurisdiction. Arity Br. 29. This argument completely misses the mark. Those cases deal with fact patterns of users accessing websites and mobile apps with nothing more, whereas here, the State’s claims involve Arity 875 intentionally targeting Texas and far more than mere use of third-party mobile apps.

In sum, the various authorities Arity 875 puts forth are easily distinguishable from the facts in this case and do nothing to bolster their argument that they have no substantial contacts with Texas. Because Arity 875 has numerous contacts with Texas related to the claims of this case, including intentionally targeting the State of Texas for data collection and marketing, this court should find that personal jurisdiction exists.

PRAYER

The Court should reverse the district court’s order granting Arity 875’s Special Appearance and remand for further proceedings. Respectfully Submitted,

Ken Paxton Attorney General of Texas

Brent Webster First Assistant Attorney General

Ralph Molina Deputy First Assistant Attorney General

Austin Kinghorn Deputy Attorney General for Civil Litigation

Johnathan Stone Chief, Consumer Protection Division

CERTIFICATE OF COMPLIANCE

Microsoft Word reports that this document contains 5,285 words, excluding exempted text.

/s/ Rick Berlin Rick Berlin Assistant Attorney General

Automated Certificate of eService This automated certificate of service was created by the efiling system. The filer served this document via email generated by the efiling system on the date and to the persons listed below. The rules governing certificates of service have not changed. Filers must still provide a certificate of service that complies with all applicable rules.

Zeilic Contreras on behalf of Richard Berlin Bar No. 24055161 zeilic.contreras@oag.texas.gov Envelope ID: 105608727 Filing Code Description: Brief Requesting Oral Argument Filing Description: Appellants Reply Brief Status as of 9/15/2025 3:52 PM CST

Associated Case Party: State of Texas Name BarNumber Email TimestampSubmitted Status Rick Berlin Rick.Berlin@oag.texas.gov 9/15/2025 3:46:35 PM SENT Daniel Zwart Daniel.Zwart@oag.texas.gov 9/15/2025 3:46:35 PM SENT Kaylie Buettner Kaylie.Buettner@oag.texas.gov 9/15/2025 3:46:35 PM SENT Zoann Willis zoann.willis@oag.texas.gov 9/15/2025 3:46:35 PM SENT Meredith Spillane Meredith.Spillane@oag.texas.gov 9/15/2025 3:46:35 PM SENT Zeilic Contreras Zeilic.Contreras@oag.texas.gov 9/15/2025 3:46:35 PM SENT Carlos Fernandez Carlos.Fernandez@oag.texas.gov 9/15/2025 3:46:35 PM SENT Madeline Fogel madeline.fogel@oag.texas.gov 9/15/2025 3:46:35 PM SENT Richard RMcCutcheon richard.mccutcheon@oag.texas.gov 9/15/2025 3:46:35 PM SENT Case Contacts Name BarNumber Email TimestampSubmitted Status W. Reid Wittliff reid@wittliffcutter.com 9/15/2025 3:46:35 PM SENT Jake Sommer jake@zwillgen.com 9/15/2025 3:46:35 PM SENT Kelsey Harclerode kelsey@zwillgen.com 9/15/2025 3:46:35 PM SENT Sudhir V. Rao sudhir.rao@zwillgen.com 9/15/2025 3:46:35 PM SENT