Avast, the cybersecurity software company, is facing a $16,5 million fine after it was caught storing and selling customer information without their consent. The Federal Trade Commission (FTC) announced the fine on Thursday (PDF) and said it prohibits Avast from selling user data for advertising purposes.
From at least 2014 to 2020, Avast collected user browsing information through its software and browser extension, according to the FTC complaint. This allowed her to collect data on religious beliefs, health concerns, political opinions, locations and economic status. The company then stored that information "indefinitely" and sold it to more than 100 third-party companies without its customers' knowledge, the complaint states.
A common research by Motherboard and PCMag first brought attention to Avast's data privacy practices in 2020. Avast shut down its data collection arm, called Jumpshot, shortly after the reports surfaced. Although Avast said it removed identifying information before selling user data, the FTC found that it "failed to adequately anonymize consumer browsing information." The company sold data with unique identifiers for each browser, revealing websites its customers visited, timestamps, the type of device and browser used, and location.
The FTC also alleges that Avast misled users by saying its software would help eliminate web tracking — when in fact it did the opposite. In addition to the $16,5 million fine, the FTC's proposed order prohibits the “sale or licensing of any browsing data” from Avast products to advertisers. It also demands that the company delete all browsing data it got from Jumpshot. Avast is also required to notify affected customers that their data was sold without their knowledge.
