Avast, a free antivirus software company, has packaged and sold user data. Avast and AVG products have been tracking users’ online activity, such as user search and click activity, according to an investigation conducted by VICE and PCMag. Avast claimed that data could not be linked to individual users.
The investigation revealed that Avast, via its antivirus software, collected data which was then sent to Jumpshot, a subsidiary of Avast. Jumpshot then repackaged and sold the data to other companies. Companies that bought or potentially bought the data include Google, Yelp, Microsoft, McKinsey, Pepsi, Home Depot, Condé Nast and Intuit. “Some clients paid millions of dollars for products that include a so-called ‘All Clicks Feed,’ which can track user behavior, clicks, and movement across websites in highly precise detail.” Data was only collected from users that opted-in to share data. However, users were often unaware that Avast sold browsing data. For the All Clicks Feed, Jumpshot noted it collects, “Every search. Every click. Every buy. On every site.”
The data does not contain names, email or IP address, but the wide-ranging nature of the data, including location and browsing data, could be used to identify individuals. A user’s browsing history will have a device ID, which remains until the user uninstalls Avast.
Customers used Avast’s web browser plugin to warn them of suspicious sites. But a blog post from AdBlock Plus showed that the company used the plugin to collect data. Mozilla, Opera, and Google have removed Avast and AVG’s extension from their browsers’ stores. In 2015, Avast explained the data it collected and shared. Avast has now claimed that it has stopped collecting this data.
Home Depot, one of the parties who purchased data from Jumpshot, echoed Avast’s insistence that the data was anonymized. “We sometimes use information from third-party providers to help improve our business, products and services. We require these providers to have the appropriate rights to share this information with us. In this case, we receive anonymized audience data, which cannot be used to identify individual customers.”
“In 2018, as part of a request for information by antitrust authorities, Yelp’s policy team was asked to estimate the impact of Google’s anticompetitive behavior on the local search marketplace,” a Yelp spokesperson stated. “Jumpshot was engaged on a one-time basis to generate a report of anonymized, high-level trend data which validated other estimates of Google’s siphoning of traffic from the web. No PII was requested or accessed.”
Sen. Ron Wyden (D-Ore.) stated on Twitter that “I’m looking into this troubling report about Avast and its failure to protect consumers’ data.”