The Federal Trade Commission (FTC) said Thursday it will ban antivirus giant Avast from selling consumers' web browsing data to advertisers after Avast claimed its products would prevent its users from being tracked online.
Avast also settled federal regulator charges for $16.5 million, which the FTC said will provide redress to Avast users whose sensitive browsing data was improperly sold to advertising giants and data brokers.
“Avast promised users that its products would protect the privacy of their browsing data, but delivered just the opposite,” said Samuel Levine, director of the FTC's Bureau of Consumer Protection, in a statement on Thursday. “Avast's bait-and-switch surveillance tactics compromised consumer privacy and violated the law,” Levine said.
The FTC said Avast collected customers' online browsing habits for years, including their web searches and the websites they visited, using Avast's own browser extensions, which the antivirus giant said would “protect your privacy” by blocking online tracking cookies.
But the FTC alleged that Avast sold consumers' browsing data through its now-closed subsidiary, Jumpshot, to more than a hundred other companies, generating Avast tens of millions of dollars in revenue.
The regulator said the browsing data sold by Jumpshot revealed consumers' religious beliefs, health concerns, political leanings, their location and other sensitive information.
A joint investigation of Vicenews and PCMag in January 2020 revealed that Jumpshot was selling highly sensitive web browsing data to companies including Google, Yelp, Microsoft, Home Depot, and consulting giant McKinsey. Reports found that Jumpshot was also selling access to its users' click data, including the specific web links its users clicked on.
At the time, Avast had more than 430 million active users worldwide. Jumpshot said it had access to data from 100 million devices.
Avast closed its Jumpshot subsidiary days after the joint Vice-PCMag report.
Avast merged with Norton LifeLock in an $8.1 billion deal in 2021 and is now owned by parent company Gen Digital, which also owns computer utility app CCleaner.
When reached for comment Thursday, Gen Digital representative Jess Monney provided TechCrunch with a statement saying: “When Avast voluntarily shut down Jumpshot in 2020, it had ceased these practices. “The operational provisions of the agreement are consistent with Avast’s current privacy and security programs.”
Avast's statement said it disagreed with the government's “allegations and characterization of the facts,” without specifying how or why, but that the company was “pleased to resolve this matter.”
