Antivirus firm Avast is reportedly selling users' web browsing data
Sensitive browsing data is repackaged and sold by a subsidiary called Jumpshot, according to a Motherboard and PCMag investigation.
- Carrie has lived on both coasts and can definitively say that Chesapeake Bay blue crabs are the best.
Avast says it has more than 400 million users around the globe.
Avast, which makes free antivirus software that's used by millions of people around the world, is reportedly selling "highly sensitive" web browsing data via a subsidiary company called Jumpshot. The software appears to track users clicks and movements across the web, and collects data on things like searches on Google and Google Maps , as well as visits to specific LinkedIn pages, YouTube vids and porn websites, according to an investigation published Monday by Motherboard and PCMag.
The collected data is then reportedly repackaged and sold by Jumpshot, which says on its website that it's able to deliver data on users actions behind "the Internet's most valuable walled gardens." Some past and present Jumpshot customers, as well as potential clients, include Google, Yelp, Microsoft, Pepsi, Home Depot, Intuit and others, according to the report, which cites "leaked user data, contracts and other company documents."
In an emailed statement Monday, a spokeswoman for Avast said Jumpshot doesn't acquire "personal identification information, including name, email address or contact details," and that users have always had the option to opt out of sharing data with Jumpshot.
"As of July 2019, we had already begun implementing an explicit opt-in choice for all new downloads of our AV, and we are now also prompting our existing free users to make an opt-in or opt-out choice, a process which will be completed in February 2020," said the spokeswoman, adding that the company understands and takes seriously "the responsibility to balance user privacy with the necessary use of data for our core security products."
Avast reportedly asks users to opt in to data collection via a pop-up message in the antivirus software. However, "multiple" users told Motherboard they were unaware that their browsing data was then sold.
The company's privacy policy says, with consent, personal data is used to "create a de-identified data set that is provided to Jumpshot to build trend analytics products and services."
Jumpshot didn't respond to a request for comment.
Originally published Jan. 27, 8:27 a.m. PT.
Update, 9:28 a.m.: Adds comment from Avast.
Correction, Jan. 28: An earlier version of this story listed Sephora as a Jumpshot customer. The company on Tuesday said, "Sephora is not a client and has not worked with Avast/Jumpshot."