Avast free antivirus sends browser history to marketers

When you install an antivirus program -- even a free one -- you have a reasonable assumption that it's going to help keep your data safe.

But a joint investigation by Motherboard and PCMag has discovered that Avast's free antivirus is harvesting user data. Although this is supposedly 'de-identified' it is being sold to marketers in a way that can be linked back to an individual.

The data is being sold by Avast subsidiary Jumpshot and while data is never linked to an individual's name, email or IP address, each user history is assigned to an identifier known as the device ID, which will persist unless the user uninstalls the Avast antivirus product.

Data is collected on individual clicks and combining this information with other data that a company might hold, such as the data and time of a purchase, could allow a user to be identified. The T&Cs also allow Jumpshot to retain the data for three years.

"Maybe the (Jumpshot) data itself is not identifying people," Gunes Acar, a privacy researcher who studies online tracking told PCMag. "Maybe it's just a list of hashed user IDs and some URLs. But it can always be combined with other data from other marketers, other advertisers, who can basically arrive at the real identity."

One particular customer for the data, marketing provider Omnicom Media Group, has been receiving 'all clicks' data feeds with device IDs attached.

When PCMag asked Avast about the data collected, it declined to answer most of the questions but did say it has stopped collecting marketing data via the Avast and AVG browser extensions.

Acar believes there's no need for the company to be collecting visited URLs. "It can be done in a more private way. Avast should definitely adopt that. But it seems they're in the business of making money from the URLs."

When installing AVG or Avast there is a pop-up asking for permission to collect anonymized data, but it doesn’t mention how the data could be used to collect back to you, nor that it can be held for three years.

You can disable browser history collection through the Settings panel of the software, so if you’re running Avast it's a good idea to do this if you haven't already.

Image credit: Amir Kaljikovic/Shutterstock