FTC Responds to Avast Selling Browsing Data – Says It Won’t “Hesitate to Take Appropriate Action as Necessary”


Yesterday, investigative reports revealed how Avast was using its free antivirus software to harvest user data and sell its users' every search, every click, and every buy on every site. The company is pulling off some regular, cookie cutter jujitsu to show the world how it was actually doing us a favor by coming up with an "ethical way" of collecting and selling browsing data.

In a blog post - which is using an image of a "happy family" with a dog and a toy [but, of course] - the company explains how its collected data helps it detect and stop billions of attacks globally. Avast emphasises that it anonymized all the personally identifiable information (PII) before selling it for millions of dollars to the likes of Google, Microsoft, Home Depot, and marketing firms.

How Avast Uses Its Antivirus Software to Harvest Data and Sell “Every Search. Every Click. Every Buy. On Every Site.”

"We want to reassure our users that at no time have we sold any personally identifiable information to a third party," the antivirus maker writes.

"We want to give confidence to all our users and partners that they have made the right decision to choose Avast and reassure them that their privacy is secure and their personal data safe."

We are then being linked to a privacy policy, which is supposed to give users all the information, but Avast should know more than most companies (since it's tracking all your clicks) that none of its users are actually clicking on that link to read that policy.

Avast then tells us that when it launched Jumpshot in 2015, it wanted to "create an innovative way to provide marketers with trend analytics and statistics on customer purchasing habits that was anonymized, rather than specific user targeting that has been historically pervasive on the web." The company says it wanted to introduce a way to sell browsing data in an ethical way.

We knew it was critical that the browsing data be handled in an ethical way, including de-identifying personal information and requiring that individuals would not be targeted for marketing and advertising.

The company says while it "acted fully within legal bounds," it has listened to the "recent feedback" and has taken "steps to align with the expectations of our users and continue to consider how a trends analytics service aligns with our values as a cybersecurity and privacy company."

FTC responds to Avast's data collection and selling practices

In response to Avast/AVG selling users browsing data using evasive opt-ins, the Federal Trade Commission (FTC) has said that it will not hesitate to take appropriate action when necessary. The Commission said in a statement sent to the media (emphasis is ours):

FTC investigations are nonpublic so we can’t comment on whether we are investigating a particular matter. However, we are very familiar with how these markets for data operate, and will not hesitate to take appropriate action as necessary where we find conduct that violates the laws we enforce.

The story has generated criticism from Washington, as well. "This story fits a pattern of the largest technology corporations trampling over the rights of consumers with near impunity," Bernie Sanders, the Democratic presidential candidate, said. "No reasonable person would expect antivirus software to be selling off their private browsing data to the highest bidder."

- Microsoft Should Release Windows 7 as Free Software to “Undo Past Wrongs,” FSF Says