When it’s free, you’re the product, remember? The United States Federal Trade Commission (FTC) has just fined Avast $16.5 million for selling its users’ browsing data to third parties, a sanction accepted by the company, which specified that it had reached an agreement with the American regulator.
According to the American competition authority, the famous antivirus of Czech origin has in fact deceived its customers for years by claiming that any sharing of information on its users would be done in an anonymous and global form. The publisher even launched a version of its browser in 2018 highlighting arguments around the protection of privacy.
Hundreds of customers
However, adds the FTC, users’ browsing data was sold to around a hundred customers in a non-aggregated form allowing identification. This business went through Jumpshot, a subsidiary of Avast, which reported having a catalog of one hundred million users around the world.
The case was revealed at the beginning of 2020 by Vice.com and PC Mag. Both media outlets reported at the time that the data sold, while not including personal information such as user names, contained a lot of specific browsing data.
At the time, Avast’s CEO estimated that this data sale represented just under 5% of the company’s total revenue, which amounted to just under $430 million. The publisher then announced the closure of its subsidiary following the scandal.
Prohibitions
Avast “failed to sufficiently anonymize consumers’ browsing information,” summarizes the FTC in its press release. And note that the flow of data sold included a unique identifier for each browser, the sites visited, the type of device and browser, the city, and the country.
The antivirus publisher is now required to no longer sell browsing data for its Avast products, and to obtain specific consent for such sales for its other products. The company will finally have to delete all data transmitted to its Jumpshot subsidiary.