Avast, a prominent cybersecurity company, has been slapped with a $16.5 million fine by the Federal Trade Commission (FTC) for unlawfully selling user data. The company is also prohibited from selling user data for advertising and must delete all data obtained by its Jumpshot arm.
FTC’s Action: The FTC announced the penalty on Thursday, citing Avast’s unauthorized collection and sale of user browsing information. The company allegedly gathered data on customers’ religious beliefs, health issues, political views, locations, and financial status through its antivirus software and browser extension, reported The Verge on Friday.
Avast then sold this data to over 100 third parties without user knowledge. Despite Avast’s claims that it removed identifying information before selling user data, the FTC found that the company “failed to anonymize consumers’ browsing information sufficiently.” The FTC also accused Avast of deceiving users by claiming its software would eliminate web tracking when, in fact, it conducted the tracking itself.
In addition to the fine, the FTC’s proposed order mandates that Avast must stop selling or licensing any browsing data from its products to advertisers and delete all web browsing data obtained by Jumpshot. The company is also required to inform affected customers that their data has been sold without their consent.
Significance: The FTC’s action against Avast comes amid a larger crackdown on data privacy violations. In January, the FTC settled with Outlogic (formerly X-Mode Social) and InMarket, preventing these data brokers from selling information that can be used to track users’ locations.
Earlier, in a privacy dispute with the FTC, Meta Platforms Inc., the parent company of Facebook, Instagram, and WhatsApp, suffered a legal setback. The U.S. District Court for the District of Columbia’s Judge Timothy Kelly dismissed Meta’s appeal for the court to intervene in its ongoing row with the FTC.
The FTC’s recent actions, including scrutiny of Elon Musk’s potential breach of a federal privacy order, indicate a heightened focus on data privacy and security breaches by both individuals and corporations.
