Avast Free Antivirus collects your data and resells it

Avast, the free antivirus collects user data and resells it. Avast spies on the sites you visit and your browsing habits, then resells everything at a high price

Avast Free Antivirus collects your data and resells it

Avast spies on users

The famous Avast antivirus and antimalware software ended up in the eye of the hurricane: the free version rakes up user data and sells it at a high price. And users apparently don’t know.

But let’s proceed calmly and try to analyze the situation.

Avast antivirus free spies users’ browsing habits

So far nothing new: we know very well that all free software and services, precisely in exchange for their gratuity, analyze and commercially exploit our data.

It does GoogleFacebook, they do thousands of other services and online tools. And of course the free antivirus Avast is no different.

The problem arises when these data, which should be analyzed, collected and resold anonymously (to protect user privacy), in reality are not (at least not completely).

How it all started

A survey conducted jointly by Motherboard and PCMag has shown how Avast operates a meticulous and detailed collection of the activities that the user performs online and then resells them, through a subsidiary, to third parties. Third parties that would then be large-scale commercial realities: Microsoft, Google, Pepsi, Intuit, Condé Nast, McKinsey just to name a few.

The investigation began after the two newspapers came into contact with a confidential document sent by Avast’s subsidiary, Jumpshot, to one of its customers.

The Avast extension for web browsers

Analyzing the problem in detail, it seems that up to a few years ago Avast collected the browsing data of users who had installed its free browser plugin designed to report any suspicious or unsafe websites.

The fact came to light when a security researcher had shown how Avast actually collected user data through that plugin.

Following those revelations Mozilla, Opera and Google have removed Avast browser extensions from their respective repositories.

Avast has told Motherboard and PCMag that it has since finished sending the data collected by these extensions to its Jumpshot subsidiary, which is precisely responsible for selling the information to its customers.

In reality, however, the problem persists.

In fact, when installing an Avast antivirus for the first time on the computer, the  user is shown an authorization request on the collection of information.

Here is the message that appears when installing the free version of Avast on Windows and Mac PCs:

“If you allow us to do this, we will provide our Jumpshot subsidiary with a set of de-identified data derived from your browser history in order to allow Jumpshot to analyze market trends and other value insights. The data is fully de-identified and aggregated and cannot be used to personally identify you. Jumpshot may share this aggregate data with its customers.”

The problem, again, is that it doesn’t explain in any way how Jumpshot uses this information.

Of course, the user still has the freedom not to give his consent, but in 99% of cases the users accept the clause without even reading it (stupid them, of course) and so they find themselves being spied on by Avast without even knowing it. And without even knowing what exactly Avast collects and resells on their browsing sessions.

The numbers

Avast claims to have over 435 million active users per month, while  Jumpshot claims to have data from 100 million devices.

We are talking about a crazy amount of data.

What are the data collected?

As anticipated, the data collected by Avast through its antivirus are really a lot: we talk about information on GPS coordinates of Google Maps, Linkedin pages visited by users, YouYube videos, sites and pornographic content, all with very precise details on searches carried out and on the exact moment of the day with a time stamp.

These details contribute to generate strong, very strong doubts about whether the data can actually be anonymized.

The information, although lacking in details to facilitate personal identification, such as user names, according to experts can lose this veil of confidentiality if combined with other sets of information (dataset).

Here is what the data collected anonymously by Avast looks like:

Data collected by avast

To a normal user these data say nothing, but Amazon, for example, takes half a second to exactly identify the user who bought an iPad Pro 10.5 at 12:03 on January 1, 2019.

So in the end, this data is not so anonymous. Clear?

Avast’s answer

An Avast spokesperson promptly stated that Jumpshot does not collect “personally identifiable information, including name, email address or contact details.”

Users have always had the opportunity to give up sharing data with Jumpshot. As of July 2019, we had already started implementing an explicit opt-in choice for all new downloads of our antivirus and we are now also urging our existing users to make an opt-in or opt-out choice, in a process to be completed in February 2020,” added the spokesman.

“We have long experience in protecting devices and user data from malware and we understand and take seriously the responsibility of balancing user privacy with the necessary use of data for our security products.”

What to do?

The problem is not so much that Avast does things in an unclear way, but the fact that it is not exactly clear what information is collected and how it is used.

Waiting for clarification, however, Avast users would do well to recheck the antivirus settings NOW and possibly block the possibility of collecting personal and private information.

Leave a Comment

Your email address will not be published. Required fields are marked *

We use cookies for providing you with the best-possible user experience. By using PrivacySavvy, you accept our privacy policy.
Cookies settings
Accept
Privacy & Cookie policy
Privacy & Cookies policy
Cookie name Active

Privacy Policy

What information do we collect?

We collect information from you when you register on our site or place an order. When ordering or registering on our site, as appropriate, you may be asked to enter your: name, e-mail address or mailing address.

What do we use your information for?

Any of the information we collect from you may be used in one of the following ways: To personalize your experience (your information helps us to better respond to your individual needs) To improve our website (we continually strive to improve our website offerings based on the information and feedback we receive from you) To improve customer service (your information helps us to more effectively respond to your customer service requests and support needs) To process transactions Your information, whether public or private, will not be sold, exchanged, transferred, or given to any other company for any reason whatsoever, without your consent, other than for the express purpose of delivering the purchased product or service requested. To administer a contest, promotion, survey or other site feature To send periodic emails The email address you provide for order processing, will only be used to send you information and updates pertaining to your order.

How do we protect your information?

We implement a variety of security measures to maintain the safety of your personal information when you place an order or enter, submit, or access your personal information. We offer the use of a secure server. All supplied sensitive/credit information is transmitted via Secure Socket Layer (SSL) technology and then encrypted into our Payment gateway providers database only to be accessible by those authorized with special access rights to such systems, and are required to?keep the information confidential. After a transaction, your private information (credit cards, social security numbers, financials, etc.) will not be kept on file for more than 60 days.

Do we use cookies?

Yes (Cookies are small files that a site or its service provider transfers to your computers hard drive through your Web browser (if you allow) that enables the sites or service providers systems to recognize your browser and capture and remember certain information We use cookies to help us remember and process the items in your shopping cart, understand and save your preferences for future visits, keep track of advertisements and compile aggregate data about site traffic and site interaction so that we can offer better site experiences and tools in the future. We may contract with third-party service providers to assist us in better understanding our site visitors. These service providers are not permitted to use the information collected on our behalf except to help us conduct and improve our business. If you prefer, you can choose to have your computer warn you each time a cookie is being sent, or you can choose to turn off all cookies via your browser settings. Like most websites, if you turn your cookies off, some of our services may not function properly. However, you can still place orders by contacting customer service. Google Analytics We use Google Analytics on our sites for anonymous reporting of site usage and for advertising on the site. If you would like to opt-out of Google Analytics monitoring your behaviour on our sites please use this link (https://tools.google.com/dlpage/gaoptout/)

Do we disclose any information to outside parties?

We do not sell, trade, or otherwise transfer to outside parties your personally identifiable information. This does not include trusted third parties who assist us in operating our website, conducting our business, or servicing you, so long as those parties agree to keep this information confidential. We may also release your information when we believe release is appropriate to comply with the law, enforce our site policies, or protect ours or others rights, property, or safety. However, non-personally identifiable visitor information may be provided to other parties for marketing, advertising, or other uses.

Registration

The minimum information we need to register you is your name, email address and a password. We will ask you more questions for different services, including sales promotions. Unless we say otherwise, you have to answer all the registration questions. We may also ask some other, voluntary questions during registration for certain services (for example, professional networks) so we can gain a clearer understanding of who you are. This also allows us to personalise services for you. To assist us in our marketing, in addition to the data that you provide to us if you register, we may also obtain data from trusted third parties to help us understand what you might be interested in. This ‘profiling’ information is produced from a variety of sources, including publicly available data (such as the electoral roll) or from sources such as surveys and polls where you have given your permission for your data to be shared. You can choose not to have such data shared with the Guardian from these sources by logging into your account and changing the settings in the privacy section. After you have registered, and with your permission, we may send you emails we think may interest you. Newsletters may be personalised based on what you have been reading on theguardian.com. At any time you can decide not to receive these emails and will be able to ‘unsubscribe’. Logging in using social networking credentials If you log-in to our sites using a Facebook log-in, you are granting permission to Facebook to share your user details with us. This will include your name, email address, date of birth and location which will then be used to form a Guardian identity. You can also use your picture from Facebook as part of your profile. This will also allow us and Facebook to share your, networks, user ID and any other information you choose to share according to your Facebook account settings. If you remove the Guardian app from your Facebook settings, we will no longer have access to this information. If you log-in to our sites using a Google log-in, you grant permission to Google to share your user details with us. This will include your name, email address, date of birth, sex and location which we will then use to form a Guardian identity. You may use your picture from Google as part of your profile. This also allows us to share your networks, user ID and any other information you choose to share according to your Google account settings. If you remove the Guardian from your Google settings, we will no longer have access to this information. If you log-in to our sites using a twitter log-in, we receive your avatar (the small picture that appears next to your tweets) and twitter username.

Children’s Online Privacy Protection Act Compliance

We are in compliance with the requirements of COPPA (Childrens Online Privacy Protection Act), we do not collect any information from anyone under 13 years of age. Our website, products and services are all directed to people who are at least 13 years old or older.

Updating your personal information

We offer a ‘My details’ page (also known as Dashboard), where you can update your personal information at any time, and change your marketing preferences. You can get to this page from most pages on the site – simply click on the ‘My details’ link at the top of the screen when you are signed in.

Online Privacy Policy Only

This online privacy policy applies only to information collected through our website and not to information collected offline.

Your Consent

By using our site, you consent to our privacy policy.

Changes to our Privacy Policy

If we decide to change our privacy policy, we will post those changes on this page.
Save settings
Cookies settings