Joseph Cox

Last year Avast was caught harvesting users' browsing data through its browser extensions. Google, Mozilla, etc removed them. But we've found through leaked documents + other info that the collection hasn't stopped. It now happens through the AV itself https://www.vice.com/en_us/article/qjdkq7/avast-antivirus-sells-user-browsing-data-investigation …pic.twitter.com/FuTc2UtakS

In short, Avast collects the data by its antivirus product being installed on peoples' computers. It then provides that data to its subsidiary Jumpshot, which then sells products based on the data to clients https://www.vice.com/en_us/article/qjdkq7/avast-antivirus-sells-user-browsing-data-investigation …pic.twitter.com/qKClRX1OKW

We obtained information on past, current, and potential clients (such as those the company has had conversations with). They include huge consulting firms, tech giants, everyday brands, web services. There is a secretive business for selling browsing data https://www.vice.com/en_us/article/qjdkq7/avast-antivirus-sells-user-browsing-data-investigation …pic.twitter.com/qhhTJIsyKl

Before selling the data Jumpshot/Avast removes personal info like names. But multiple experts believe you could identify people inside it. The data itself is also highly sensitive, being able to see specific porn videos and searches people looked at https://www.vice.com/en_us/article/qjdkq7/avast-antivirus-sells-user-browsing-data-investigation …pic.twitter.com/DCLEP0qbXB

Was taken aback by the bluntness of Avast/Jumpshot's internal documents on its sale of users' browsing data. "The data set is almost like an Apache log for the entire Internet for every device in the panel." https://www.vice.com/en_us/article/qjdkq7/avast-antivirus-sells-user-browsing-data-investigation …pic.twitter.com/fvwpR25q1S

Here is the description of the All Clicks Feed from an internal document. Data taken from users of Avast antivirus, put into this product, and then data provided to clients in granular detail. "All Clicks Feeds will let you see all of the activity." https://www.vice.com/en_us/article/qjdkq7/avast-antivirus-sells-user-browsing-data-investigation …pic.twitter.com/nl1LFi6djr

And selling this browsing data is big business. A Jumpshot contract we obtained showed sales of browsing data for over $2,000,000 a year, to just one client. https://www.vice.com/en_us/article/qjdkq7/avast-antivirus-sells-user-browsing-data-investigation …pic.twitter.com/NAgJDq5gXi

After being caught selling user data, Avast is currently getting its entire userbase to opt into the data collection. But multiple users I spoke to didn't even know Avast sells browsing data; suggesting its not really informed consent https://www.vice.com/en_us/article/qjdkq7/avast-antivirus-sells-user-browsing-data-investigation …pic.twitter.com/h8ef60PF3o

Statement from Senator Wyden, whose office has been engaging with Avast directly to get answers on why the company sells browsing data. Wyden concerned Avast has not committed to delete the browsing data it collected without consent https://www.vice.com/en_us/article/qjdkq7/avast-antivirus-sells-user-browsing-data-investigation …pic.twitter.com/SXhb2otW87

Avast said it is not possible to identify individual users from its sold browsing data. Some clients, like Home Depot, we spoke to said the same. Experts think otherwise though, especially when a client combines Avast data with their own https://www.vice.com/en_us/article/qjdkq7/avast-antivirus-sells-user-browsing-data-investigation …pic.twitter.com/quCuXZUal8

This piece on Avast browsing data selling was a collaboration between Motherboard and PCMag. In their own piece, PCMag goes more into how the data could be de-anonymized. The outlet has now also pulled Avast from its recommendations of free antivirus https://www.pcmag.com/news/the-cost-of-avasts-free-antivirus-companies-can-spy-on-your-clicks …pic.twitter.com/3uauOev24I

This is the new opt-in message that should be popping up on more Avast antivirus users' screens soon. It arguably isn't clear on what Jumpshot really does with this data: collect browsing history which can see what site you were on at what time, sells it https://www.vice.com/en_us/article/qjdkq7/avast-antivirus-sells-user-browsing-data-investigation …pic.twitter.com/caL71F9fJm

Updated from FTC on Avast selling its antivirus users' browsing data: "We are very familiar with how these markets for data operate, and will not hesitate to take appropriate action as necessary where we find conduct that violates the laws we enforce." https://www.vice.com/en_us/article/7kzxzy/senator-mark-warner-ftc-not-doing-enough-on-browsing-data-avast-antivirus …pic.twitter.com/Ex6qm4FsfN