In a decisive move, the Federal Trade Commission (FTC) has brought down the hammer on Avast, a company once championed for its cybersecurity solutions. For years, Avast offered browser extensions and antivirus tools, branding itself as a bastion against the surveillance of users’ online activities. However, this image has been tarnished by revelations that, from 2014 to 2020, Avast was covertly harvesting users’ browser information and then selling it to over 100 companies through Jumpshot, an analytics firm it rebranded after acquiring.
The FTC’s complaint discloses that the sale of this data included detailed, re-identifiable information about consumers’ digital lives, far from the “anonymous and aggregate” data Avast claimed to be sharing. This data was not just any run-of-the-mill browsing info—it was granular enough to include job searches, map directions, and even visits to “cosplay erotica” sites.
The irony is bitter. Avast’s software, which promised to “block annoying tracking cookies that collect data on your browsing activities” and “shield your privacy,” was simultaneously enabling the very privacy infringements it vowed to protect against. In what may seem a double-cross of its customers’ trust, Avast’s actions have led to a proposed FTC order (PDF) that includes a $16.5 million settlement—expected to provide redress to consumers.
Per the FTC’s stipulations, Avast will now be forbidden from selling future browsing data and will be required to secure express consent for any future data gathering. Additionally, it must notify customers about past data sales and implement a “comprehensive privacy program” to rectify previous misconduct. Despite disagreeing with the FTC’s allegations, Avast has expressed its commitment to resolving the matter and continuing service to its customers.
In a blog post accompanying its announcement, FTC Senior Attorney Lesley Fair emphasizes that, alongside Avast’s privacy products and Jumpshot’s extensive tracking, the FTC is now regarding browsing data as “highly sensitive information that requires utmost caution.” Fair emphasizes that “data about the websites a person visits isn’t just another corporate asset open to unfettered commercial exploitation.”
Relevant articles:
– Avast ordered to stop selling browsing data from its browsing privacy apps. Identifiable data included job searches, map directions, “cosplay erotica.”
– FTC Orders Avast to Pay $16.5M for Selling User’s Browsing Data, GBHackers, Sun, 25 Feb 2024 04:50:54 GMT
– FTC says Avast promised privacy, but pirated consumers’ data for treasure, Federal Trade Commission News, Thu, 22 Feb 2024 05:08:55 GMT
– Avast ordered to pay $16.5 million for misuse of user data, Help Net Security, Fri, 23 Feb 2024 11:13:20 GMT