On June 27, 2024, the US Federal Trade Commission (FTC) finalized an order against Avast Limited, along with its subsidiaries Avast Software s.r.o and Jumpshot, Inc., following a February settlement to address the sale of browsing data for advertising purposes.
Background
The FTC’s investigation revealed that Avast unfairly collected and sold consumers’ browsing data through its browser extensions and antivirus software. The company falsely claimed that its products would protect user privacy while secretly selling detailed and re-identifiable browsing data to over 100 third parties.
Findings
The FTC’s complaint included several key points:
- Deceptive Privacy Practices: Avast’s privacy policy failed to disclose the sale of browsing data.
- Lack of Consumer Consent: Consumers were not adequately informed or consented to the sale of their data.
- Misleading Privacy Claims: Avast misrepresented its data aggregation and anonymization processes.
Order Provisions
- Monetary Penalty: Avast must pay $16.5 million within nine days of the order’s effective date, to be used for consumer redress.
- Data Deletion: The company must delete all web browsing data transferred to Jumpshot and any derived products or algorithms.
- Consumer Notification: Avast must notify consumers whose data was sold without consent about the FTC’s actions.
- Privacy Program: Avast is required to establish a comprehensive privacy program to prevent future violations.
Not the first rodeo
In The Privacy Explorer #16 you can read about the history of the Avast blunder and that Avast has been fined CZK 351 million (approx. USD 14,9 million) by the Czech Office for Personal Data Protection.
👉 Read more here.
♻️ Share this if you found it useful.
💥 Follow me on Linkedin for updates and discussions on privacy, digital and AI education.
📍 Subscribe to my newsletter for weekly updates and insights – subscribers get an integrated view of the week and more information than on the blog.
