As the famous saying goes, “If you're not paying for the product, you are the product”. Recent investigations by Motherboard and PCMag revealed how antivirus firm Avast, which owns AVG, has been making a profit by selling users' web browsing data.
Avast provides one of the most popular “free” antivirus software in the world, with over 400 million users, based on Avast’ website. However, the software was said to have been tracking users’ clicks as well as movements across the internet, collecting data on web searches, page visits, online purchases and even their porn viewing habits and preferences.
The company was said to have been selling the “highly sensitive” web browsing data via a subsidiary company called Jumpshot, who would then sell the data to its clients – which includes the likes of Google, Microsoft, Sephora, TripAdvisor, Pepsi, Yelp and Home Depot. Jumpshot states on its website that it can deliver discrete data on users’ actions behind “the Internet's most valuable walled gardens.”
Avast claimed that the data goes through a de-identification process which means that it can’t be traced back to individual users. Nevertheless, the PCMag article demonstrated how major companies like Amazon, Google, and branded retailers and marketing firms, which are also known to amass vast amounts of user activity logs, could easily merge the anonymised data provided by Jumpshot to pinpoint the user’s real identity.
In October 2019, security researcher and creator of AdBlock Plus, Wladimir Palant, revealed how Avast was harvesting user data by logging every website they visited through its web browser extension designed to warn users of suspicious websites. In response, browser makers such as Mozilla, Google and Opera removed the extensions provided by Avast and AVG from their respective browser extension stores for exhibiting these spyware-like properties.
Avast said in a statement to Motherboard and PCMag that Avast has since stopped sending browsing data collected by these extensions.
This whole revelation just proves how nothing is actually “free” and everything comes at a cost – in the online services world, it’s usually your personal data and preferences. It also shows how fragile digital trust could be when even companies we expect to protect us from the threats are resorting to backhanded means to monetise its customers.