Cybersecurity Firm Avast Collects And Sells Your Personal Data Via Their Free Antivirus Program

Cheap is great, free will cost you. Czech cybersecurity firm Avast Software s.r.o which owns popular free products such as Avast Antivirus and its subsidiary AVG is reportedly selling your web browsing data via a subsidiary called Jumpshot. This means that users who thought they were using freeware have in real sense been paying with their data.

Investigations were initiated jointly by Vice’s Motherboard and PCMag after Adblock Plus creator Wladimir Palant reported in October, 2019 that the Avast Online Security Extension as well as the AVG Secure Browser spy on users, harvesting their information.

Palant claimed that user information—which included a unique user ID, the page you visited, whether you’d visited that page before, and other information— was being provided to third parties, and suggested that Jumpshot could be a possible destination. (Avast acquired Jumpshot in 2013, and a statement on the company’s website says that it “provides insights into consumers’ online journeys by measuring every search, click and buy across 1,600 categories from more than 150 sites, including Amazon, Google, Netflix, and Walmart.”).

Jumpshot subsidiary has relationships with firms like Google, Pepsi, Microsoft, and Home Depot. PCMag and Motherboard managed to gain access to internal documents and a sample of data from Jumpshot, and they found Avast is tracking user clicks down to the second. Here’s an example of Jumpshot’s data format.

Device ID: abc123x Date: 2019/12/01 Hour Minute Second: 12:03:05 Domain: Amazon.com Product: Apple iPad Pro 10.5 – 2017 Model – 256GB, Rose Gold Behavior: Add to Cart

In above example, details of someone making a purchase on Amazon.com, including the exact time they hit add to cart including the specific product has been provided.

Previously, Avast had claimed that the data sold has been “de-identified” and hence can’t be used to personally identify users, the investigation found that the anonymized data can be linked to individual users by matching user actions. “The data is fully de-identified and aggregated and cannot be used to personally identify or target you,” Avast told users who would then opt-in to data collection program.

There is an old saying: When you’re not paying for the product, you’re the product. such is the case here, beware of the amount of freeware you install.