It collects browsing data and sells it to third parties: this is the hidden cost of the free Avast antivirus

An investigation jointly conducted by Motherboard and PCMag showed how Avast operate, using its free antivirus software and services, one meticulous and detailed collection of the activities that the user does online and then resell them, through a subsidiary, to third parties. Third parties that would then be large-scale commercial realities: Microsoft, Google, Pepsi, Intuit, Cond Nast, McKinsey just to name a few included in the report of the two newspapers.

The investigation kicked off after the two newspapers came in contact with a confidential document sent by the Avast subsidiary, jumpshot, to one of his clients.

The free antivirus asks in exchange for the possibility of tracking the user’s activities

Until a few years ago, Avast collected the browsing data of users who had installed its free browser plugin designed to report any suspicious or unsafe websites when they are accessed. The fact came to light when a security researcher had shown how Avast collected user data through that plugin. Following those revelations Mozilla, Opera and Google they removed Avast browser extensions from their respective repositories. Avast has told Motherboard and PCMag that it has since stopped sending the data collected by these extensions to its Jumpshot subsidiary, which is precisely responsible for selling the information to its customers.

However, when installing an Avast antivirus for the first time, the user is shown a request for authorization to collect information. “If you allow us to do so, we will provide our Jumpshot subsidiary with a set of de-identified data derived from your browser history in order to allow Jumpshot to analyze market trends and other value insights. The data is fully de- identified and aggregated and cannot be used to identify you personally. Jumpshot could share this aggregate data with its customers “reads the message, which however does not detail how Jumpshot uses this information and which refers to a document containing the consent policies. However, the user has the freedom not to give his consent or to think about it later.

Avast claims to have over 435 million active users per month while Jumpshot claims to have data from 100 million devices. Motherboard and PCMag have contacted several users of the free antivirus who have declared that they are not aware of the fact that Avast ultimately sells browsing information to third parties.

Browsing data collected: from Google searches to adult’s sites

The data obtained from the two publications include Google searches, information on GPS coordinates of Google Maps, Linkedin pages visited by users, YouYube videos and, inevitably, sites and adult content all with very precise details on the research carried out and on the exact moment of the day with a time stamp. These details contribute to generate skepticism, as some experts contacted by the two newspapers have indicated, that the data can actually be anonymized.

“Users always have the option not to share information with Jumpshot. Since July 2019 we have already started to implement an opt-in choice for all new downloads of our antiviruses, and we are now asking our existing free users to do a explicit choice, a process that will be completed in February 2020, “said Avast.