The Competition and Markets Authority (CMA) said the deal could lead to British customers getting a worse deal when looking for cyber security software.
CMA Executive Director David Stewart said: "We are living more of our lives online and it is vital that people have access to competitive cyber safety software when seeking to protect themselves and their families,".
The two cybersecurity companies need to submit proposals to allay the regulator's concerns within five working days, after which the CMA will review their proposals and decide whether to take its investigation into phase 2.
Avast and NortonLifeLock did not immediately respond to a request for comment.