The Federal Trade Commission (FTC) on Thursday said it will ban the antivirus giant Avast from selling consumers’ web browsing data to advertisers after Avast claimed its products would prevent its users from online tracking.
Avast also settled the federal regulator’s charges for $16.5 million, which the FTC said will provide redress for Avast’s users whose sensitive browsing data was improperly sold on to ad giants and data brokers.
“Avast promised users that its products would protect the privacy of their browsing data but delivered the opposite,” said Samuel Levine, director of the FTC’s Bureau of Consumer Protection, in a statement on Thursday. “Avast’s bait-and-switch surveillance tactics compromised consumers’ privacy and broke the law,” said Levine.
The FTC said Avast collected customers’ online browsing habits for years, including their web searches and which websites they visited, using Avast’s own browser extensions, which the antivirus giant claimed would “shield your privacy” by blocking online tracking cookies.
But the FTC alleged that Avast sold consumers’ browsing data through its now-shuttered subsidiary, Jumpshot, to more than a hundred other companies, making Avast tens of millions of dollars in revenue.
The regulator said that the browsing data that Jumpshot sold revealed consumers’ religious beliefs, health concerns, political leanings, their location, and other sensitive information.
A joint investigation by Vice News and PCMag in January 2020 revealed that Jumpshot was selling the highly sensitive web browsing data to companies, including Google, Yelp, Microsoft, Home Depot, and consulting giant McKinsey. The reports found Jumpshot was also selling access to its users’ click data, including the specific web links that its users were clicking on.
At the time, Avast had more than 430 million active users worldwide. Jumpshot said it had access to data from 100 million devices.
Avast shuttered its Jumpshot subsidiary days following the joint Vice-PCMag report.
Avast merged with Norton LifeLock in an $8.1 billion deal in 2021 and now falls under the parent company Gen Digital, which also owns the computer utility app CCleaner.
When reached on Thursday for comment, Gen Digital representative Jess Monney provided TechCrunch with a statement, saying: “When Avast voluntarily closed Jumpshot in 2020 it had ceased these practices. The operational provisions of the settlement are consistent with Avast’s current privacy and security programs.”
Avast’s statement said it disagreed with the government’s “allegations and characterization of the facts,” without specifying how or why, but that the company was “pleased to resolve this matter.”
CCleaner says hackers stole users’ personal data during MOVEit mass-hack
Comment