Anti-virus company Avast has reportedly been selling its 435 million users' browsing data

Avast, a company that makes free antivirus software, which is used by over 435 million users around the globe, has reportedly been selling the web browsing data of its users. According to an investigation by Motherboard and  PCMag, Avast was using a subsidiary company called Jumpshot to sell “highly sensitive” web browsing data of its users. The software was apparently tracking data from Google and Google Maps searches, LinkedIn pages, YouTube videos, and porn websites. This data was then shared on Jumpshot, which eventually sold the data. In a recent press release, Jumpshot revealed that it has data from 100 million devices. [caption id=“attachment_6256891” align=“alignnone” width=“1024”]  Representational Image.[/caption] In a statement given to Cnet, an Avast spokesperson said that Jumpshot doesn’t acquire “personal identification information, including name, email address or contact details,” and that users have always had the option to opt-out of sharing data with Jumpshot. “As of July 2019, we had already begun implementing an explicit opt-in choice for all new downloads of our AV, and we are now also prompting our existing free users to make an opt-in or opt-out choice, a process which will be completed in February 2020,” the spokesperson said. Even if the company data does not acquire “personal information” as it claims, it still has information on specific browsing data, which could be used to deanonymise users. In a statement to Motherboard and PCMag, Avast said that it doesn’t anymore share browsing data with Jumpshot:

Until recently, Avast was collecting the browsing data of its customers who had installed the company’s browser plugin, which is designed to warn users of suspicious websites. Security researcher and AdBlock Plus creator Wladimir Palant  published a blog post in October showing that Avast harvested user data with that plugin. Shortly after, browser makers Mozilla, Opera,  and Google removed Avast’s and subsidiary AVG’s extensions from their respective browser extension stores. Avast had previously  explained this data collection and sharing in a blog and  forum post in 2015. Avast has since stopped sending browsing data collected by these extensions to Jumpshot.

However, the report found that the company’s claims were false and that the data collection is ongoing. “Instead of harvesting information through software attached to the browser, Avast is doing it through the anti-virus software itself”. It was reportedly found that Avast has recently started asking users to opt-in to data collection via a pop-up message in the antivirus software. However, “multiple” users told Motherboard they were unaware that their browsing data was then sold.