author: Bart Swiatek
Avast was Selling User Data
Avast, developer of the popular free Avast and AVG antivirus software, used the browser plug-in installed with them to collect private user data. The information was then sold to third parties by Avast's subsidiary Jumpshot.
The well-known Avast company, the developer of a popular free antivirus software, most likely sold user data using its subordinate company Jumpshot. We are talking about sensitive information, such as the history of visited pages (including pornographic sites, YouTube or LinkedIn profiles viewed), as well as searches on Google or Google Maps. The information was disclosed thanks to the cooperation of PCMag and Motherboard (the website being part of Vice), which reached the internal documents of the said subordinate.
Everything and everywhere
User data is collected using a special web browser extension that is installed together with the antivirus and is intended, ironically, to warn of dangerous web pages. They are then compiled into anonymous packages and sold. Interestingly, Jumpshot's customers include giants from many different industries. The list includes such entities as Microsoft, Google, Pepsi, Sephora, Loreal, Expedia, IBM, Home Depot, Yelp and Intuit.
Jumpshot's Privacy Policy states that the information collected is used to "create anonymous data packages that enable Jumpshot to build services and products to analyse trends". However, the editors of Motherboard confirmed that many users are not aware that their data is sold to third parties.
"Every search. Every click. Every buy. On every site", a quote from one of Jumpshot's secret trade offers.
Anonymous, so what?
Avast's spokesperson ensured that the company does not collect identification and contact data - such as names, emails or telephone numbers. Since July 2019, the company also gives new users a choice when installing the antivirus (we can refuse to participate in the Jumpshot program). A similar option is also offered to current users, who are informed about the situation through a special notification window - the change is introduced gradually (by the end of February all users should receive a choice).
It is worth noting that although the data is anonymous, in some situations the information contained therein may be used to identify a person. This is because they contain such details as the time of visiting the web page or entering the password in the search engine, together with the phrases that were used. It's pretty easy to see how serious a problem we might be dealing with. Of course, most of the entities are interested in internet trends, for which the user's identity is not needed. It cannot be ruled out, however, that one of the Jumpshot customers bought the company's packages for a completely different purpose.
It is worth noting that Avast is also responsible for another popular antivirus program - AVG. The associated plug-in was probably used in the same way.