Software provider Avast has been prohibited from selling browsing data for advertising purposes, following false claims that it would block online tracking within its products. In addition to this, the company is mandated to pay over $16.5 million in charges levied against it by the Federal Trade Commission (FTC).
The FTC released a statement indicating that Avast violated promises of protecting consumers from online tracking practices by selling consumer data to third parties. This conduct has led the FTC to restrict Avast's ability to sell or license web browsing data. The FTC complaint alleges that Avast unfairly collected consumers' browsing information through its antivirus software and browser extensions. The company stored this data indefinitely and sold it without obtaining consent from the consumers.
"Avast promised users that its products would protect the privacy of their browsing data but delivered the opposite," said Samuel Levine, Director of the FTC’s Bureau of Consumer Protection. Levine added, "Avast’s bait-and-switch surveillance tactics compromised consumers’ privacy and broke the law." According to the FTC, over 100 third parties received data from Avast's subsidiary Jumpshot. The press release indicates that illicit practices by Avast have been ongoing since at least 2014. The collected data included user web searches, location, financial status, among other sensitive information.
After acquiring Jumpshot and rebranding it as an analytics company - previously classified as a competitor antivirus software provider - Avast continued questionable practices for six years. During this period, Jumpshot sold browsing information collected by Avast from its consumers. The company claimed they used a special algorithm to remove identifiable information before transferring the gathered data to third parties. However, according to the FTC, they did not sufficiently anonymize personal consumer information before selling it.
As part of remedial measures, Avast will be required to notify consumers whose information was sold without their consent and implement a privacy program aimed at preventing future misconduct identified by the FTC.
