Did you use Avast? Your personal data has probably been sold 😵

Cliquez ici pour lire en français

Avast, the famous antivirus company, was recently fined for compromising its users’ personal data. We tell you all about it

Spyware extension and antivirus software 👀

Avast is one of the best-known antivirus products on the market. In addition to antivirus software that scans your computer for potential threats, Avast also offers browser extensions. Avast’s pledge was to « block tracking cookies collecting data on your browsing activities » to enable you to « browse in complete privacy ». However, the reality is quite different.

The Czech company Avast has been investigated by the Federal Trade Commission (FTC). This is an independent government agency in the USA, charged with protecting consumers and promoting competition. The results are quite shocking, as revealed in their report, available by clicking here. In it, we discover that Avast « unfairly collected consumers’ browsing information through the company’s browser extensions and antivirus software, stored it indefinitely, and sold it without adequate notice and without consumer consent ». This is a long way from the antivirus publisher’s promise of confidentiality.

“Avast promised users that its products would protect the privacy of their browsing data but delivered the opposite,” said Samuel Levine, Director of the FTC’s Bureau of Consumer Protection.

Sensitive data sold without being anonymized 😵

According to the FTC report, Avast collected browsing data containing a wealth of personal information. This data revealed consumers’ religious beliefs, health concerns, political leanings, location, financial status, visits to children’s content and other sensitive information. From 2014 to 2020, Avast sold this data via its subsidiary Jumpshot. This was a former rival provider of antivirus software, bought out and then rebranded by Avast as an analytics company.

But the case doesn’t end there, quite the contrary. According to the FTC, the data sold was not sufficiently anonymized or aggregated. Although Avast claimed to use a special algorithm to eliminate identifying information before transferring the data to its customers, the facts belied these claims. The FTC’s analysis revealed that the data streams included a unique identifier for each web browser. These streams could also include each website visited, precise timestamps, device and browser type, as well as city, state and country.

What’s more, Avast has not prohibited some of its data buyers from re-identifying Avast users on the basis of data supplied by Jumpshot. Even worse, some of Jumpshot’s products were developed « to allow clients to track specific users or even to associate specific users—and their browsing histories—with other information those clients had ».

A $16.5 million fine💲

For all these reasons, Avast has been fined $16.5 million. This sum is intended to repair the damage suffered by consumers. The fine also includes a proposed order. It prohibits Avast and its subsidiaries from providing false information on the use of the data they collect. The proposal also includes the following measures:

• Prohibition on Selling Browsing Data
• Obtaining affirmative Express Consent
• Deletion of data transferred to Jumpshot, as well as any products or algorithms derived from this data.
• Notify consumers whose browsing information has been sold to third parties without their consent of the FTC’s action against the company.
• Implementation of a privacy protection program.

In response to the FTC’s allegations, Avast issued a statement to The Verge, expressing its disagreement.

While we disagree with the FTC’s allegations and characterization of the facts, we are pleased to resolve this matter and look forward to continuing to serve our millions of customers around the world.

What do you think of this case? Do you use Avast antivirus? We look forward to hearing from you.

Sources : FTC, 01Net, The Verge