Avast Faces $16.5 Million Fine for Unauthorized Storing, Selling of Customer Information

The Federal Trade Commission (FTC) fined Avast $16.5 million due to its unauthorized practice of storing and selling customer information.

The cybersecurity software company will also be banned from selling user data for advertising.

Avast Collects, Sells Customer Information Without Consent

According to the FTC, the company has been gathering user web browsing information using its antivirus software and browser extension. The operation is estimated to have started from 2014 to 2020.

Avast has been harvesting information such as religious beliefs, health concerns, political views, locations, and even financial status. The complaint also stated that the company has stored data "indefinitely" and sold it to more than 100 third parties without any form of consent.

The Commission called Avast's practices bait-and-switch surveillance that has compromised the consumers' privacy and law. "Avast promised users that its products would protect the privacy of their browsing data but delivered the opposite," said Samuel Levine, Director of the FTC's Bureau of Consumer Protection

Avast Fails to Deliver Promises to Customers

The cybersecurity software company is known for promising consumer protection and blocking third-party tracking. However, the complaint detailed that the company failed to deliver its promises and also damaged its reputation with the customers.

Users of Avast browser extensions often get notifications that the software would " "block annoying tracking cookies that collect data on your browsing activities" and promised that its desktop software would "shield your privacy."

Customers were unaware that Avast and its subsidiary Jumpshot have been using the collected data information for advertising, marketing, and data analytics companies. Avast defended that it used a special algorithm to remove identifiers before transferring the data to its clients.

The FTC remained firm and will require Avast to pay $16.5 million. In addition, the company must delete the web browsing information that was transferred to Jumpshot along with a notification to the affected customers.