Senator Ron Wyden is investigating why cybersecurity company Avast collects and then sells its customers’ browsing data. Avast’s free browser plugin is not only designed to protect users, but also takes anonymized browsing history which Avast then uses to provide insights on what groups of users are doing online. The company has 400 million users, according to Avast’s website.
“Sen. Wyden’s office has reached out to Avast to express concerns about this practice and to learn more about how it operates,” a spokesperson for Wyden told Motherboard. “He’s considering next steps now.”
Videos by VICE
Earlier this month Mozilla removed Avast’s extensions as well as others made by antivirus firm AVG from its add-on portal. That came after Wladimir Palant, the creator of the AdBlock Plus extension, published a blog post showing Avast and AVG harvested user data.
As Avast’s CEO Ondrej Vlceck explained to Forbes, Jumpshot, a company that Avast owns a majority stake in, strips identifying details from that browsing data, and that “Typical customers would be, for example, investors, who would be interested in how online companies are doing in terms of their new campaigns.”
Do you know about any other companies selling browsing data? We’d love to hear from you. Using a non-work phone or computer, you can contact Joseph Cox securely on Signal on +44 20 8133 5190, Wickr on josephcox, OTR chat on jfcox@jabber.ccc.de, or email joseph.cox@vice.com.
Jumpshot’s website says the company provides “Incredibly detailed clickstream data from 100 million global online shoppers and 20 million global app users.” Customers can, the website suggests, “Analyze it however you want: track what users searched for, how they interacted with a particular brand or product, and what they bought. Look into any category, country, or domain.”
Senator Wyden also wrote in a tweet “Americans expect cybersecurity and privacy software to protect their data, not sell it to marketers. I’m looking into this troubling report about Avast and its failure to protect consumers’ data.”
Recently a security researcher found how other browser plug-ins were collecting browsing data and not only selling it, but exposing sensitive information such as home surveillance videos and medical information.
An Avast spokesperson wrote in a statement “We had a brief conversation with an aide in Senator Wyden’s office yesterday to understand and listen to their feedback. We are confident in our data processing practices and are happy to delve deeper into the conversation with the Senator’s office. We would need to consider any request for further information based on the specific nature of the inquiry.”
Update: This piece has been updated with a statement from Avast.
Subscribe to our cybersecurity podcast, CYBER.
