It has been reported that an antivirus program used by hundreds of millions of people around the world is selling highly sensitive web browsing data to many of the world’s biggest companies, a joint investigation by Motherboard and PCMag has found. The Avast division charged with selling the data is Jumpshot, a company subsidiary that’s been offering access to user traffic from 100 million devices, including PCs and phones. In return, clients—from big brands to e-commerce providers—can learn what consumers are buying and where, whether it be from a Google or Amazon search, an ad from a news article, or a post on Instagram.
The data collected is so granular that clients can view the individual clicks users are making on their browsing sessions, including the time down to the millisecond. And while the collected data is never linked to a person’s name, email or IP address, each user history is nevertheless assigned to an identifier called the device ID, which will persist unless the user uninstalls the Avast antivirus product.
Commenting on this, Sam Curry, chief security officer at Cybereason, said “Antivirus companies who get into the practice of data brokering cease to be security companies, in my opinion, and should defend themselves with clear, transparent language and should remove conflicts of interest or they are spyware luring in customers with benefits that are misleading and frankly disgusting. I hope that Avast is proved innocent for the industry’s sake, but if it’s not, I reject them as a security company until they resolve this and make amends, transparently.