FTC Slaps $16.5M Fine On Avast For Selling Users' Data To Over A Hundred Third Parties Without Consent (UPDATED)

Avast, a prominent cybersecurity company, has been slapped with a $16.5 million fine by the Federal Trade Commission (FTC) for unlawfully selling user data. The company is also prohibited from selling user data for advertising and must delete all data obtained by its Jumpshot arm.

What Happened: The FTC announced the penalty on Thursday, citing Avast’s unauthorized collection and sale of user browsing information. The company allegedly gathered data on customers’ religious beliefs, health issues, political views, locations, and financial status through its antivirus software and browser extension, reported The Verge on Friday.

Avast then sold this data to over 100 third parties without user knowledge. Despite Avast’s claims that it removed identifying information before selling user data, the FTC found that the company “failed to anonymize consumers' browsing information sufficiently.” The FTC also accused Avast of deceiving users by claiming its software would eliminate web tracking when, in fact, it conducted the tracking itself.

In addition to the fine, the FTC’s proposed order mandates that Avast must stop selling or licensing any browsing data from its products to advertisers and delete all web browsing data obtained by Jumpshot. The company is also required to inform affected customers that their data has been sold without their consent.

See Also: Mark Zuckerberg Says $7T For Sam Altman’s Chipmaking Dream Is Astronomical: ‘I Don’t Think He Is Crazy’
“Avast has reached a settlement with the FTC to resolve its investigation of Avast's past provision of customer data to its Jumpshot subsidiary that Avast voluntarily closed in January of 2020. We are committed to our mission of protecting and empowering people's digital lives. While we disagree with the FTC's allegations and characterization of the facts, we are pleased to resolve this matter and look forward to continuing to serve our millions of customers around the world,” a spokesperson Avast informed Benzinga.

Why It Matters: The FTC’s action against Avast comes amid a larger crackdown on data privacy violations. In January, the FTC settled with Outlogic (formerly X-Mode Social) and InMarket, preventing these data brokers from selling information that can be used to track users' locations.

Just last month, the FTC reached a settlement with Outlogic (formerly X-Mode Social) that prevents the data broker from selling information that can be used to track users’ locations.

Earlier, in a privacy dispute with the FTC, Meta Platforms Inc., the parent company of Facebook, Instagram, and WhatsApp, suffered a legal setback. The U.S. District Court for the District of Columbia's Judge Timothy Kelly dismissed Meta's appeal for the court to intervene in its ongoing row with the FTC.

The FTC’s recent actions, including scrutiny of Elon Musk’s potential breach of a federal privacy order, indicate a heightened focus on data privacy and security breaches by both individuals and corporations.

In 2021, Smith Micro Software acquired Avast’s Family Safety Mobile Business for $66 million, with additional earn-out based on certain milestones.

Read Next: Apple Says Don’t Bury Your Wet iPhone In Rice, Do This To Dry It Right

Image by rafapress via Shutterstock

Editor’s note: This story has been updated with comment from Avast on FTC’s fine on the company for unlawfully selling user data