Avast Is Selling Your "Every Search. Every Click. Every Buy. On Every Site."

How Avast Uses Its Antivirus Software to Harvest Data and Sell "Every Search. Every Click. Every Purchase. On Every Site."

Avast has evidently been harvesting user information through opt-ins that don't tell the consummate story to its antivirus users. If you believed your antivirus protected yous from malware, turns out information technology did that at the toll of sharing your entire online being with the buyers, including the likes of Google, Pepsi, and Domicile Depot.

A Motherboard and PCMag investigation has revealed that documents from Jumpshot, an Avast subsidiary, "polish new light on the secretive auction and supply chain of peoples' net browsing histories." Avast antivirus program has been collecting data from its users, which is and then repackaged by Jumpshot into different products sold to some of the biggest companies in the earth.

Some past, present, and potential clients include Google, Yelp, Microsoft, McKinsey, Pepsi, Sephora, Domicile Depot, Condé Nast, Intuit, and many others. Some clients paid millions of dollars for products that include a so-called "All Clicks Feed," which can track user behavior, clicks, and movement across websites in highly precise detail.

Other clients mentioned in documents include Unilever, Nestle Purina, Kimberly-Clark, IBM, and GfK.

This isn't the get-go time that Avast has come under fire for its secretive data hoarding and sharing practices. The company was found using its browser extensions to harvest user data. Upon discovery by a security researcher, Mozilla, Opera, and Google removed Avast'due south and its subsidiary AVG's extensions from their extension stores.

In response, Avast said it will stop sending browsing data collected through these extensions to Jumpshot.

However, it appears the visitor didn't accept to rely on those extensions to go on Jumpshot's business organisation alive. Jumpshot claims to its clients that it has informationfrom 100 1000000 devices. Avast claims to have over 435 million active monthly users.

While Avast says it collects that data through opt-ins, multiple users of its antivirus programme were unaware of what they were agreeing to, which begs the question of how open about this practice Avast was to its users. It is unclear when these opt-ins started, but several users noticed receiving these notifications that asked antivirus users to opt dorsum into data drove. This new opt-in bulletin reads:

"If you allow it, nosotros'll provide our subsidiary Jumpshot Inc. with a stripped and de-identified information set derived from your browsing history for the purpose of enabling Jumpshot to analyze markets and business concern trends and gather other valuable insights."

Multiple users said they did not know the antivirus maker was selling their browsing information.

"If they opt-in, that device becomes part of the Jumpshot Console and all browser-based internet activity volition be reported to Jumpshot," an internal product document revealed. The nerveless information includes, but isn't limited to:

URLs visited, in what social club and when
Google searches
Lookups of locations and GPS coordinates on Google Maps
People visiting companies' LinkedIn pages
YouTube videos
Videos users are watching on Facebook and Instagram
People visiting porn websites

"It is possible to determine from the nerveless data what date and time the anonymized user visited YouPorn and PornHub, and in some cases what search term they entered into the porn site and which specific video they watched," Motherboard reported.

While Avast says this data is anonymized and doesn't include personal data, it contains such a broad range of information that experts believe it won't be impossible to deanonymize some of the affected users.

How much Avast is being paid by its clients for this data

In one example, a marketing firm chosen Omnicom Media Group paid Jumpshot $ii,075,000 for information access in 2022, with contracts revealing payments of $two,225,000 and $2,275,000 for 2022 and 2022, respectively. Avast users from over 14 different countries, including the US, UK, Australia, and Canada, had their information shared with this New York-based company.

In response to this investigation, Avast has sent the following statement (emphasis is ours):

Because of our approach, we ensure that Jumpshot does not acquire personal identification data, including proper name, email address or contact details, from people using our pop costless antivirus software.

Users have always had the ability to opt out of sharing data with Jumpshot. Every bit of July 2022, we had already begun implementing an explicit opt-in selection for all new downloads of our AV, and we are now also prompting our existing free users to make an explicit choice, a process which will be completed in Feb 2022.

We accept a long rails tape of protecting users' devices and data against malware, and we understand and take seriously the responsibleness to balance user privacy with the necessary utilize of data.

[Update, January 29]: In a statement to Wccftech, a Sephora spokesperson has said that it isn't a customer of Avast. Equally a reminder, the leaked documents also revealed "potential" clients, and Sephora probably falls into that category.