FTC Bans Antivirus Provider Avast From Selling Users' Browsing Data

The federal regulator is also fining Avast $16.5 million for promising to protect users' privacy when it was actually harvesting their data to sell to third-party companies.

The US Federal Trade Commission is cracking down on antivirus provider Avast for secretly harvesting users’ browsing data and then selling the information to third-party companies. 

On Thursday, the FTC announced it was fining Avast $16.5 million and prohibiting the antivirus brand from selling or licensing collected user data for advertising purposes. 

“Avast promised users that its products would protect the privacy of their browsing data but delivered the opposite,” said FTC Bureau of Consumer Protection Director Samuel Levine. “Avast’s bait-and-switch surveillance tactics compromised consumers’ privacy and broke the law.”

The FTC issued the order four years after PCMag and Motherboard published a joint investigation into how Avast’s free antivirus products could expose your browsing history to corporations, even though the same products promised to protect users' privacy.  At the time, Avast claimed it was stripping out personal details before supplying the browsing data to marketers. But internal documents showed that the browsing data could still be used to link back to individual Avast users, especially when the information was combined with other data sources.   

Avast privacy settings at the time (Credit: PCMag/Michael Kan)

The FTC conducted its own investigation and found that Avast subsidiary Jumpshot had been selling users’ browsing data from 2014 to January 2020 to “more than 100 customers.” In addition, the antivirus provider managed to amass “more than eight petabytes (8000TBs) of browsing information dating back to 2014,” none of which was ever deleted. 

“This browsing data included information about users’ web searches and the webpages they visited—revealing consumers’ religious beliefs, health concerns, political leanings, location, financial status, visits to child-directed content and other sensitive information,” the FTC added. Avast’s Jumpshot also struck deals to let advertising firms Lotame and Omnicom combine the collected browsing data with their own sources, enabling them to potentially identify users. 

Although web tracking has become pervasive over the internet, the FTC says Avast violated US fair trade laws by initially failing to disclose to users that their browsing data would be sold to third parties, and later misrepresenting the collection practices.  

“The vast majority of consumers would not know that the Avast Software would surveil their every move on the Internet or that their browsing information might be sold to more than 100 third parties and stored indefinitely, in granular, re-identifiable form,” the FTC’s order adds. 

In response, the Commission is ordering Avast to delete “the web browsing information transferred to Jumpshot and any products or algorithms Jumpshot derived from that data.” The FTC is also forcing Avast to obtain consent from users before selling or licensing collected user data for non-Avast products. 

Source