When a pirate says “Avast!” it’s a nautical term that means “Listen, stop talking.” When the FTC says “Avast!” it means the same thing to software company Avast. Avast Limited in the UK tells consumers that using its software will protect their privacy by preventing the tracking and collection of their browser information. But according to the FTC, from 2014 to 2020, guess who was tracking consumers’ browser messages and then selling them to more than 100 other companies through an affiliate called Jumpshot? Ironically, Avast Limited. We’re not sure how many doubloons the $16.5 million in financial compensation amounts to, but we hope the terms of the proposed settlement serve as a reminder to other companies blaming Davy Jones’ locker for such behavior.
For consumers concerned about privacy, the promotion of Avast’s antivirus software and browser extensions has raised eyebrows. The company promises that its product will block “annoying tracking cookies that collect data about your browsing activity.” In a major app store, the company pitches its Avast mobile software as a way for consumers to “protect your device” by sending your personal data to their servers when you install it. Receive alerts about spyware and adware applications that protect your privacy.” In describing its desktop software, Avast promises that it will “protect your privacy” and “block anyone and everyone from accessing your computer.” Avast also tells people that its software will allow them to “take back your browser.” Get rid of unwanted extensions and hackers to make money from your searches. ” The company’s marketing for Avast Secure Browser highlights its anti-tracking capabilities and promises it will “protect[] Protect your privacy by preventing websites, advertising companies, and other online services from tracking your online activities. ”
It’s a huge irony for the FTC that Avast is making these privacy promises while selling consumers’ browser histories.
You’ll have to read the complaint for details about what Avast allegedly did behind the scenes, but part of the story relates to its 2014 acquisition of antivirus business Jumpshot. Avast rebrands Jumpshot as an analytics firm that claims its “[m]”More than 100 million online consumers worldwide” will provide Jumpshot’s customers with “unique insights to make better business decisions.” ” Jumpshot further claims that its clients are able to “see where your audience goes before and after visiting your site or a competitor’s site, and even track those who visit specific URLs. Jumpshot, of course, has a lot of data about what people browse (some of it highly personal in nature) and sells that data to advertising agencies, data brokers, personal brands, SEO agencies and others looking for consumer details. The agent for information about browsing history is Avast, a company that positions its product as a solution for intrusive online surveillance.
According to the complaint, Jumpshot provides its customers with “extremely detailed information about how consumers browse the Internet, including every web page visited, precise timestamps, type of device and browser, and city, state, and country.” More Important Unfortunately, most of the data contains unique and persistent device identifiers, allowing Jumpshot and its clients to track individuals over time and across multiple domains. The information sold by Jumpshot included data on consumer visits to religious affairs, political candidates, health issues such as breast cancer, jobs at secure military installations, student loan application information, dating interests and adult websites, the FTC said. nature. The complaint states: “The vast majority of consumers are unaware that Avast software monitors their every move online, and that their browsing information may be sold to more than 100 third parties and used in a fine-grained, reprocessed manner. Defined manner stored indefinitely. – Recognizable form.”
In many cases, Avast did not disclose its data-sharing practices at all, but even when it did, the FTC claimed its “disclosures” — such as the hard-to-find and difficult-to-understand statements in its privacy policy — were disingenuous. For example, Avast’s privacy policy stated at one point that any browsing information shared with third parties would be anonymized and presented in aggregate form. The Federal Trade Commission says otherwise. According to the complaint, the data Avast sold through Jumpshot contained shocking details about individual consumers’ browsing habits. Furthermore, contrary to Avast’s explicit promises to consumers who download its products, Jumpshot’s agreements with some of its customers make it clear that the companies intend to “re-link” their purchased data to individual consumers for targeting and targeting purposes consumer purpose. track.
The proposed complaint involves Avast Limited, Avast Software sro., and Jumpshot, Inc., alleging that the companies unfairly collected, retained, and sold consumers’ browsing information in violation of the FTC Act; deceptively failed to disclose that they were tracking consumers; and misrepresents that consumers’ browsing information will only be shared in an aggregated and anonymized form, which is not the case.
In addition to the $16.5 million in financial remedies the FTC intends for consumer restitution, the proposed order includes far-reaching provisions designed to address the harm the company caused to consumers who downloaded its products and protect people in the future. Among other things, the proposed settlement would prohibit the sale or disclosure of Avast users’ browsing information to third parties for advertising purposes. This includes any insights, models or algorithms derived from that data. The order also prohibits the use of consumers’ browsing information for third-party advertising without the consumer’s explicit consent. In addition, respondents must delete certain browsing information, including any models, algorithms or software developed using the data, and instruct third parties to delete the data as well. To ensure consumers know what Avast is doing behind the scenes, the company must post a notice on its website and notify consumers via email. Avast must also implement a comprehensive privacy program and undergo external evaluation. Once the proposed settlement is published in the Federal Register, the FTC will accept public comments for 30 days.
Whether you’re a young kid or a veteran, the FTC’s action against Avast includes guidance to help prevent your company from getting stranded in a law enforcement wreck.
All companies must live up to their privacy commitments, but this is especially true for businesses that market their products as ways for consumers to protect their privacy. There aren’t enough r’s in “Arrrrrrrgghh” to express the FTC’s concerns about a company that promotes its products as a way for people to maintain their privacy online and then deceives them by selling highly personalized browsing information. The irony and hurt in this case are shocking, and the FTC will show no mercy when companies lie to consumers about how they protect their personal information.
You can’t promise privacy to consumers and then go full steam ahead on your contract with your customers. The FTC said that in some cases, contracts with third-party customers did not prohibit the companies from re-identifying Avast users based on information provided by Jumpshot. In other cases, Jumpshot products are designed to allow customers to track specific users and even associate specific users and their browsing history with other information the customer has. The range of consumer profiles Jumpshot sells is almost immeasurable. For example, in its contract with advertising giant Omnicom, Jumpshot agreed to provide “all click sources” (during a given user’s browsing session) to 50% of its user base in the United States, United Kingdom, Mexico, Australia, and other countries. all URLs clicked). Canada and Germany cover all areas.
Viewing data is a highly sensitive type of information and requires extreme caution. Recent actions by the FTC have focused on the confidential nature of certain categories of consumer information, such as health information or geolocation. But consumers’ browsing information is also highly sensitive. Information about the websites a person visits is not just another Company asset available for unrestricted commercial exploitation.
