Antivirus Software Maker Fined $16.5 Million for Selling Users’ Data

Consumers put their faith and trust in antivirus and other digital security companies to safeguard their devices and online activities and to keep personal information private.

When the Federal Trade Commission (FTC) announced Feb. 22 that it had fined antivirus software creator Avast $16.5 million to “settle charges that the company sold such information to third parties after promising that its products would protect consumers from online tracking,” some people may have been taken aback.

United Kingdom-based Avast Ltd., through a since disposed-of Czech subsidiary named Jumpshot, collected and stored consumers’ browsing information that it obtained through antivirus software and browser extensions. Without consumers’ consent, it sold that data to more than 100 third parties, including advertisers, marketing and data analytics companies, and data brokers, the FTC says.

‘It’s an irony not lost on the FTC’

“Avast promised users that its products would protect the privacy of their browsing data but delivered the opposite,” Samuel Levine, director of the FTC’s Bureau of Consumer Protection, said in a statement from the government agency. “Avast’s bait and switch surveillance tactics compromised consumers’ privacy and broke the law.” 

The alleged activity took place from 2014 to 2020. As part of the punishment, the FTC also banned Avast from selling web browsing data for advertising.

“It’s an irony not lost on the FTC that Avast made … privacy promises while trafficking in consumers’ browser histories,” FTC attorney Lesley Fair wrote in a blog post about the fine.

In its own statement shared with AARP, Avast acknowledged that it “reached a settlement with the FTC to resolve its investigation of Avast’s past provision of customer data to its Jumpshot subsidiary that Avast voluntarily closed in January of 2020.”

“We are committed to our mission of protecting and empowering people’s digital lives,” Avast officials went on to say. “While we disagree with the FTC’s allegations and characterization of the facts, we are pleased to resolve this matter and look forward to continuing to serve our millions of customers around the world.”

How does the FTC’s action affect you?

The FTC plans to publish a consent agreement in the Federal Register soon. Then the public will have 30 days to comment on the agreement before it is made final.