Avast has agreed to cough up $16.5 million after the FTC accused the antivirus vendor of selling customer information to third parties.
The US regulator filed [PDF] a lengthy complaint against Avast regarding its use and alleged misuse of customer data.
Avast apparently sold the data through a subsidiary, Jumpshot, that it purchased in 2014 and set up as an analytics firm.
According to the FTC's allegations it sold browsing information collected by its parent from 2014 until Avast grounded the biz in 2020 when allegations of customer data sales emerged.
Beyond simply collecting and selling the data, the FTC argued that Avast's attempts to anonymize user info were paltry at best - allowing buyers to easily re-associate their data troves with an individual.
By 2020 when it was shut down, Jumpshot had reportedly amassed more than eight petabytes of browsing data, according to the FTC complaint.
In addition to paying $16.5 million to the FTC, Avast has been prohibited from selling browser data and must destroy all web browsing data transferred to Jumpshot as well as any algorithms derived from said data.
Avast will also have to ensure it secures express consent for data licensing from users, implement a privacy program, and inform all users whose data was sold by Jumpshot about the FTC's decision.
Avast has not admitted guilt - a typical outcome in these sorts of scenarios.
This Cyber News was published on go.theregister.com. Publication date: Fri, 23 Feb 2024 01:13:05 +0000