FTC Bans Antivirus Provider Avast From Selling Users' Browsing Data

[KnownStormChaser]

https://www.pcmag.com/news/ftc-bans-antivirus-provider-avast-from-selling-users-browsing-data

Quote

The US Federal Trade Commission is cracking down on antivirus provider Avast for secretly harvesting users’ browsing data and then selling the information to third-party companies.

On Thursday, the FTC announced it was fining Avast $16.5 million and prohibiting the antivirus brand from selling or licensing collected user data for advertising purposes.

“Avast promised users that its products would protect the privacy of their browsing data but delivered the opposite,” said FTC Bureau of Consumer Protection Director Samuel Levine. “Avast’s bait-and-switch surveillance tactics compromised consumers’ privacy and broke the law.”

The FTC issued the order four years after PCMag and Motherboard published a joint investigation into how Avast’s free antivirus products could expose your browsing history to corporations, even though the same products promised to protect users' privacy.  At the time, Avast claimed it was stripping out personal details before supplying the browsing data to marketers. But internal documents showed that the browsing data could still be used to link back to individual Avast users, especially when the information was combined with other data sources.  

The FTC conducted its own investigation and found that Avast subsidiary Jumpshot had been selling users’ browsing data from 2014 to January 2020 to “more than 100 customers.” In addition, the antivirus provider managed to amass “more than eight petabytes (8000TBs) of browsing information dating back to 2014,” none of which was ever deleted.

“This browsing data included information about users’ web searches and the webpages they visited—revealing consumers’ religious beliefs, health concerns, political leanings, location, financial status, visits to child-directed content and other sensitive information,” the FTC added. Avast’s Jumpshot also struck deals to let advertising firms Lotame and Omnicom combine the collected browsing data with their own sources, enabling them to potentially identify users.

Although web tracking has become pervasive over the internet, the FTC says Avast violated US fair trade laws by initially failing to disclose to users that their browsing data would be sold to third parties, and later misrepresenting the collection practices.  

“The vast majority of consumers would not know that the Avast Software would surveil their every move on the Internet or that their browsing information might be sold to more than 100 third parties and stored indefinitely, in granular, re-identifiable form,” the FTC’s order adds.

In response, the Commission is ordering Avast to delete “the web browsing information transferred to Jumpshot and any products or algorithms Jumpshot derived from that data.” The FTC is also forcing Avast to obtain consent from users before selling or licensing collected user data for non-Avast products.

Avast has decided to comply with the FTC’s order. In a statement, it told PCMag: “Avast has reached a settlement with the FTC to resolve its investigation of Avast’s past provision of customer data to its Jumpshot subsidiary that Avast voluntarily closed in January of 2020. We are committed to our mission of protecting and empowering people’s digital lives. While we disagree with the FTC’s allegation and characterization of the facts, we are pleased to resolve this matter and look forward to continuing to serve our millions of customers around the world.”

In January 2020, the company terminated Jumpshot, the Avast subsidiary charged with selling the harvested user data. Avast has since merged with NortonLifeLock to form a new parent company called Gen.

The FTC adds that the $16.5 million fine “is expected to be used to provide redress to consumers.” Avast must also notify all consumers who had their browsing information sold to the third-party companies without their consent.

 

[David H. Lipman]

FYI:  Post ID:1619112