Antivirus program tracked users' porn habits, sold browsing data

Antivirus program Avast, which is used by hundreds of millions of people, collected and sold users' most secretive browsing data to some of the world's largest companies until 2019.

Once Avast was installed on computers, it collected user browsing data, and its subsidiary Jumpshot then repackaged that data and sold it to companies like Google, Microsoft, Pepsi, Yelp, Trip Advisor, Home Depot and more, according to a joint report by Vice's Motherboard and PCMag, citing leaked Jumpshot documents.

Avast told FOX Business in a statement that it "completely discontinued the practice of using any data from [its] browser extensions for any other purpose that the core security engine, including sharing with ... Jumpshot" in 2019.

"Users have always had the ability to opt-out of sharing data with Jumpshot. ... We are now also prompting our existing free users to make an opt-in or opt-out choice, a process which will be completed in February 2020," the company added.

Some companies pay millions of dollars for access to users' web-browsing activity through software companies like Avast. This user data includes information on which websites people visited and their activity on those sites.

Clients had the ability to see what some anonymized Avast users searched on Google, Google Maps, YouTube, LinkedIn and porn websites. In some cases, clients could see what keywords users searched and videos users watched on explicit sites like YouPorn and Pornhub, the report shows.

VIDEO CALL APP ZOOM ADDS SECURITY FIXES AFTER EAVESDROP HACK DISCOVERED

Avast has 435 million customers who use its antivirus software, according to its website, and Jumpshot collects data from about 100 million devices worldwide, a 2018 Marketing Land report shows.

"In 2018, as part of a request for information by antitrust authorities, Yelp's policy team was asked to estimate the impact of Google’s anticompetitive behavior on the local search marketplace. Jumpshot was engaged on a one-time basis to generate a report of anonymized, high-level trend data, which validated other estimates of Google’s siphoning of traffic from the web," a Yelp spokesperson told Motherboard and PCMag.

A Home Depot spokesperson said the hardware store will "sometimes use information from third-party providers to help improve our business, products and services. We require these providers to have the appropriate rights to share this information with us. In this case, we receive anonymized audience data, which cannot be used to identify individual customers."

SPACEX LAUNCHES 4TH BATCH OF STARLINK SATELLITES AS IT BUILDS INTERNET SERVICE

Microsoft told the outlets it no longer works with Jumpshot.

But even though Avast users are anonymized when the program sells their data, their browsing information is sometimes so specific that it can reveal identities, experts said.

"It's very granular, and it's great data for these companies because it's down to the device level with a timestamp," one source told Motherboard and PCMag of the specificity and sensitivity of this data being sold.

Avast said in its statement that the antivirus company ensures that "Jumpshot does not acquire personal identification information, including name, email address or contact details, from people using our popular free antivirus software."

GET FOX BUSINESS ON THE GO BY CLICKING HERE

Avast added in its statement that its "Privacy Policy details the protections we put in place" for all of its users.

"Users can also choose to adjust their privacy levels using the broad range of settings available in our products, including control over any data sharing at any time. We voluntarily comply with the GDPR and California Consumer Privacy Act (CCPA) privacy requirements across our entire global user base," the statement said.

CLICK HERE TO READ MORE ON FOX BUSINESS

"We have a long track record of protecting users’ devices and data against malware, and we understand and take seriously the responsibility to balance user privacy with the necessary use of data for our core security products," the company added.