The report by Vice’s Motherboard built upon reports by Adblock Plus creator Wladimir Palant, who reported in October 2019 that the Avast Online Security Extension as well as the AVG Secure Browser spy on users, harvesting their information.
Palant claimed the data which included a unique user ID, the page you visited, whether you’d visited that page before, and other information—could be provided to third parties, and suggested that Jumpshot could be a possible destination.
For those who came in late, Avast bought Jumpshot in 2013 with the idea that it “provides insights into consumers’ online journeys by measuring every search, click and buy across 1,600 categories from more than 150 sites, including Amazon, Google, Netflix, and Walmart”.
At the time, the news caused browser makers like Google to remove both from its web store, though the extensions have since returned.
In the report, Avast told Motherboard/PCMag that data collected by the Avast browser extensions is no longer provided to Jumpshot. But other sources alleged that it is instead collecting that same information from the Avast and AVG free antivirus programs. That data is then passed along to Jumpshot, those sources said, and from there to its corporate clients.
“Last week, months after it was spotted using its browser extensions to send data to Jumpshot, Avast began asking its existing free antivirus consumers to opt-in to data collection, according to an internal document”, Motherboard wrote.
In a statement, Avast said that it “acted quickly to meet browser store standards” and in December completely discontinued the practice of using any data from the browser extensions for any other purpose than improving the core security engine. “We ensure that Jumpshot does not acquire personal identification information, including name, email address or contact details”, the statement said.
The statement went on to describe the opt-in and opt-out choices available. “Users have always had the ability to opt-out of sharing data with Jumpshot. As of July 2019, we had already begun implementing an explicit opt-in choice for all new downloads of our AV, and we are now also prompting our existing free users to make an opt-in or opt-out choice, a process which will be completed in February 2020.”
Avast’s statement has tried to minimise concerns about its practices and said it had a long track record of protecting users’ devices and data against malware.
"We understand and take seriously the responsibility to balance user privacy with the necessary use of data for our core security products”, Avast added.
The company said that it complies with the European GDPR and the California Consumer Privacy Act, and referred users to its privacy policy for more information. This allows Avast to “enable use of your personal data to create a de-identified data set that is provided to Jumpshot to build trend analytics products and services”.
When installing the free Avast antivirus software, users are given the option to uncheck virtually all of the optional modules that the software installs: password storage, disk cleanup, and more. By default, the Avast security browser extension and SafePrice browser extension have a checkmark next to them, showing that they will be installed. Those can be unchecked and not installed.
