Your Antivirus is Spying on You: Avast Was Quietly Selling Web Browsing Data of Millions of its Users

Onerep brings you the latest news from the world of data. Stay tuned to learn about high profile data breaches, harvesting, misuse and other cybersecurity incidents involving both major companies and individuals.

According to the recent investigation of Motherboard and PCMag, Avast antivirus widely used all over the world has been selling highly sensitive browsing data of its users to many of the world’s biggest companies. Avast client list includes Google, Yelp, Microsoft, Pepsi, Sephora, Home Depot, Condé Nast, and many others.

 Cyber security news

The data sold by the antivirus giant enables buyers to track clicks, user behavior and movement across websites in very precise detail. It also features Google searches, Google Maps locations and GPS coordinates lookups, companies’ LinkedIn pages visiting history, particular YouTube videos, and people visiting porn websites. The collected data allows to determine what date and time the anonymized user visited YouPorn and PornHub, and in some cases what search term they entered and which specific video they watched.

Although the data does not include personal information such as users’ names, it still contains a great deal of specific browsing data. Experts say it could be possible to de-anonymize some users.

Avast has sold peoples’ internet browsing histories via a subsidiary called Jumpshot through a simple arrangement: the antivirus program installed on a person’s computer collected the data that Jumpshot repackaged into various products and sold to clients. 

The antivirus company that has over 435 million active users per month claims that they have only sold the data of the users who knew their information was gathered because of the active opt-in procedure Avast employed. However, multiple users claim that they were unaware Avast sold their browsing data, posing questions about how informed that consent was.

The news received wide online coverage resulting in Avast’s promise of 30 January 2020 to shut down all its data collecting activities with immediate effect. 

Mary Shishkova

OneRep privacy specialist