That is not true when looking at the per browsing session data gathered. Google only knew the same amount of data when the website the user was browsing on used Google services and the user was logged into Google, same applies to Facebook only knew the same amount of data when the website used Facebook services and the user was logged into Facebook.
In a broader context, you are right that Facebook and Google collect far more big data than Avast has ever collected. But then again Avast's primary business is to protect their users from malware while Facebook and Google primary business is selling targeted advertisements based on big data collection.
On top of that the CEO of Avast himself published that at second thought the gathering and selling consumer data did not fit well with a company aiming to protect their users. In this age of 'alternative facts' I think it adds to Avast credit that Avast did not played down the relative loss of privacy* nor the fact that the user gave his/her consent, but decided to defend their reputation.
* Data could only be de-personalized when the AVAST data could be matched with data of their own website in which the user revealed its identity (e.g. sign-on for email/info/coupon, shopping cart check-out, website log-in, etc). In all of these cases the identity of the user would be known anyway. Buying Avast data "only"provided insight in surfing behavior before the user landed on the website buying this data.