Antivirus program Avast was found to be selling user data to a number of huge companies, including Google, Microsoft and Pepsi.
The revelation was uncovered through an investigation by Motherboard and PCMag. The investigation found user data, contracts and leaked reports, showing that Avast had been selling highly sensitive data that should have remained private. Among the recipients of said data were the aforementioned companies, along with others, such as Yelp, McKinsey, Home Depot, Condé Nast, Intuit and more.
According to the investigation, when users installed Avast on their computers, the program would collect data. A subsidiary called Jumpshot would package and prepare it to be sold off to any number of various large companies, some of which paid millions of dollars for the data. In some cases, companies paid for “All Clicks Feed” data, tracking individuals’ browser histories, clicks and online movements in precise detail.
Avast has said it has around 435 million active users per month, and Jumpshot said it has data from about 100 million devices. The service is reportedly supposed to ask users to opt into sharing data, though many Avast users told reporters that they were never informed about any kind of data sharing, and didn’t opt in to their knowledge.
Some of the data collected includes locations and coordinates on GPS maps, LinkedIn pages, viewed YouTube videos and porn websites that people have visited, among many other examples. Though users’ names are not included, the data involves a number of specific data references that could lead to a user’s identity.
When asked about its relationship with Jumpshot, Microsoft only said that it no longer has any connection with the company. Yelp said it had engaged with Jumpshot one time years ago for a particular project regarding Google’s anticompetitive behavior. IBM said it had no record of being a client of Jumpshot.