Avast faces $16.5M fine from FTC for illicit user data trade

Avast faces a significant setback after the Federal Trade Commission (FTC) levied a substantial $16.5 million penalty for the unauthorised sale of users’ browsing data acquired through its antivirus software and browser plugins. This fine, issued in connection with a 2020 investigation conducted in partnership with PCMag, exposes Avast’s misleading data practices.

The FTC’s investigation revealed that Avast, a UK-based company, collected consumers’ browsing information through its browser extensions and antivirus software, storing it indefinitely and selling it without proper notice or user consent. The company’s subsidiary, Jumpshot, played a crucial role in selling this data to over 100 third parties. Shockingly, the complaint discloses that Jumpshot retained an astounding eight petabytes of browsing information spanning from 2014 to 2020.

 

Avast collected sensitive data without the knowledge of its antivirus software users.

 

Documents found during the investigation revealed a concerning amount of collected data, including details like Google searches, Maps locations, YouTube views, LinkedIn profiles, and visits to explicit websites. Users of Avast’s antivirus software were unaware of this extensive data collection.

The FTC alleges that Avast misled users by falsely claiming its software would protect privacy through third-party tracking prevention while simultaneously selling detailed, re-identifiable browsing data. Avast’s anonymisation process, according to the FTC, was insufficient, leading to the sale of data in non-aggregate, re-identifiable form.

Jumpshot, Avast’s data-selling arm, packaged and sold products like the “All Click Feed,” allowing clients to purchase information on all clicks observed on specific sites. The company generated tens of millions in gross revenue through this data-selling practice.

In response to the investigation, Avast promptly shut down Jumpshot operations, and the FTC issued a civil investigative demand. Senator Ron Wyden, who had previously raised concerns about Avast’s data practices, commended the FTC for its crackdown on the company.

Avast, now under the ownership of Gen Digital, has settled with the FTC. While the company disagrees with the allegations, it expresses a commitment to protecting and empowering users’ digital lives. The resolution allows Avast to continue serving millions of customers globally, although under the watchful eye of authorities concerned about user privacy in the ever-expanding digital landscape.