The U.S. Federal Trade Commission (FTC) will order Avast to pay $16.5 million and ban the company from selling the users' web browsing data or licensing it for advertising purposes.
The
complaint says Avast violated millions of consumers' rights by collecting, storing, and selling their browsing data without their knowledge and consent while misleading them that the products used to harvest their data would block online tracking.
"While the FTC's privacy lawsuits routinely take on firms that misrepresent their data practices, Avast's decision to expressly market its products as safeguarding people's browsing records and protecting data from tracking only to then sell those records is especially galling,"
said FTC Chair Lina M. Khan.
"Moreover, the volume of data Avast released is staggering: the complaint alleges that by 2020 Jumpshot had amassed "more than eight petabytes of browsing information dating back to 2014."
More specifically, the FTC says UK-based company Avast Limited harvested consumers' web browsing information without their knowledge or consent using Avast browser extensions and antivirus software since at least 2014.
Avast data feeds included unique identifiers for each web browser and a combination of info on every website visited, timestamps, type of device and browser, as well as the users' city, state, and country. When describing its data-sharing practices, the company also falsely claimed it would only transfer the users' personal information in an aggregate and anonymous form.
The FTC also said Avast stored this information indefinitely and sold it to over 100 third parties between 2014 and 2020 through their Jumpshot subsidiary.
For instance, Jumpshot made an agreement with advertising company Omnicom, which allowed it to access 50% of Jumpshot's customer data from six countries: the United States, the United Kingdom, Mexico, Australia, Canada, and Germany, as alleged in the complaint.
Avast also purportedly misled users by promising to protect their privacy by blocking third-party tracking. However, it failed to inform them that their detailed, re-identifiable browsing data would be sold.
