Avast is selling its users sensitive data through its subsidiary Jumpshot, US media reports.
The company denies the allegations and says it ended the practices described in December.
Avast acquired Jumpshot, a manufacturer of PC performance optimization tools in 2013. But analysis of two US servers from the end of last year shows, Jumpshot also serves as a reseller of user data. The company sells the data it collects to clients such as Coca Cola, Google, and Microsoft.
Every search, every click…
The price of data for individual clients is in the millions of dollars, HN reports. Jumpshot has data on “every search, every click, every purchase on any page.”
Motherboard and PCMag were anonymously provided data samples that Avast shared with partners. The data contained users private internet activity on Google.com, Google maps, LinkedIn.com, Youtube, and pornographic sites.
Jumpshot also sells fully anonymized data that clients use to to identify trends. For example, Omnicom Media Group pays $2 million annually to access this type of data, according to Avast.
On Monday, the company issued a statement denying the reports.
“In December 2019, we responded quickly to meet the standards of web browsers. Now our online security extension meet these requirements. We ended the use of web browser add-on data…,” the statement said.
Antivirus collects user data
The company says that the data is anonymous. However, documents from Jumpshot show that users of the Avast or AVG browser extensions receive unique identifiers. The identifier only changes if the user completely uninstalls and reinstall the Avast products.
Avast says they have obtained user consent. The current version of Avast Free Antivirus displays information about the data collection during the installation. But it also contains misleading statements on the use of data to improve products. The sale of user data to third parties doesn’t appear in the terms.
Motherboard’s new findings show that the data collection continues. Rather than the browser extensions collecting data the antivirus itself now collects data. After detecting a problem with the browser add-on, AVG began asking users of the free version of antivirus to consent to data collection.
Mozilla, Opera, and Google Chrome removed Avast and AVG extensions in December. As a result of AdBlock Plus developers discovery that Avast was collecting user data.