Avast banned from selling user browsing data for advertising purposes

The Federal Trade Commission (FTC) this week has taken action against Avast Plc, a UK-based software company, for allegedly deceiving users about its data collection practices.

The FTC alleges that Avast collected users' browsing data through its browser extensions and antivirus software and then sold this information to third parties for advertising purposes, without obtaining users' explicit consent.

Here's a breakdown of the FTC's allegations and the final order issued against Avast:

• Unfair Collection and Sale of Browsing Data: According to the FTC, Avast collected a significant amount of users' browsing data, including websites visited, search queries, and online purchases. The FTC alleges that Avast did not adequately disclose this data collection in its privacy policy and failed to obtain users' affirmative consent before selling this information to third parties.
• Deceptive Practices: The FTC further alleges that Avast misled users by claiming that its software products would protect their privacy by blocking third-party tracking. However, the FTC contends that Avast itself was engaged in third-party tracking by selling users' browsing data.

To settle the charges, Avast has agreed to the following terms in the FTC order:

• Ban on Selling Browsing Data: Avast is prohibited from selling or licensing any user browsing data obtained through its non-Avast software products for advertising purposes.
• Data Deletion: Avast must delete all web browsing information it previously transferred to its subsidiary, Jumpshot, which was allegedly involved in the data sales. Additionally, Avast must delete any products or algorithms derived from this data.
• User Consent: Avast is required to obtain clear and affirmative express consent from users before selling or licensing browsing data from non-Avast products to third parties for advertising purposes.
• Notification to Users: Avast must notify users whose browsing information was sold to third parties without their consent about the FTC's actions against the company.
• Privacy Program Implementation: Avast must implement a comprehensive privacy program that addresses the data collection and sales practices highlighted by the FTC.

This FTC order serves as a reminder for software companies to be transparent about their data collection practices and to obtain user consent before selling user data for advertising purposes.