The US FTC says Avast needs to pay $16.5M and stop selling web browsing data for ads to settle charges that the UK company misrepresented its use of such data
antivirus giant hit with major fine Greg Noone / Tech Monitor : Avast slapped with $16.5m fine from FTC for selling user data without permission Efe Udin / Gizchina : FTC fines Avast $16.5 million in the US for selling user browsing information without permission Ernestas Naprys / Cybernews.com : Avast to pay $16.5M over charges of unfair user data sales Benzinga : FTC Slaps $16.5M Fine On Avast For Selling Users' Data To Over A Hundred Third Parties Without Consent Rob Thubron / TechSpot : Avast fined $16.5 million by FTC for selling user browsing data to advertisers Ryan Naraine / SecurityWeek : FTC Accuses Avast of Selling Customer Browsing Data to Advertisers The Hacker News : FTC Slams Avast with $16.5 Million Fine for Selling Users' Browsing Data Michael Kan / PCMag : FTC Bans Antivirus Provider Avast From Selling Users' Browsing Data Brandon Vigliarolo / The Register : Avast shells out $17M to shoo away claims it peddled people's personal data Pierluigi Paganini / Security Affairs : FTC charged Avast with selling users' browsing data to advertising companies Heinrich Long / RestorePrivacy : FTC Fines Avast $16.5 Million and Bans Firm from Selling User Data Suzanne Smalley / The Record : FTC hits Avast with $16.5 million fine over allegations of selling users' browsing data Joseph Cox / 404 Media : FTC Fines Avast $16.5 Million For Selling Browsing Data Harvested by Antivirus Mastodon: Paul Knightly, PhD / @paulknightly@mstdn.social : When I say that I'm completely and utterly disillusioned that when a company claims that data intended to be private will be kept private, this is why. — https://techcrunch.com/... Alesandro Ortiz / @AlesandroOrtiz@infosec.exchange : Browser extensions selling your web browsing data?! *surprised Pikachu* — It's an open secret in the extension world. I have some years-long research in this area that I hope to publish later this year. — IMO, the FTC should also take action against Google for misleading CWS policies, and hundreds/thousands of extensions for also selling web browsing data in the same manner. … X: Jason Kint / @jason_kint : Interesting order alleging ad blocker extension was deceiving consumers. I wonder if the FTC knows Google previously paid A LOT of money to the largest ad blocker on the planet who in return didn't block Google's ads while at the same time blocked publishers ads. Billions. Joseph Cox / @josephfcox : Impact: FTC is fining cybersecurity company Avast $16.5 million. This is in response to mine and @Michael_Kan's investigation based on internal documents that revealed Avast was using its AV to harvest browsing data and then sell it at a massive scale https://www.404media.co/... Wendy Davis / @wendyndavis : @Avast antivirus company, which sold browsing data until 2020 (as reported by @jason_koebler) was fined $16.5m by @FTC. Avast had contracts with @LiveRamp, @Lotame, @Omnicom, accdg to complaint. Recipients of data include https://www.ftc.gov/... [image] @ftc : FTC order will ban Avast from selling browsing data for advertising purposes, require it to pay $16.5 million over charges the firm sold browsing data after claiming its products would block online tracking: https://www.ftc.gov/... #privacy /1 LinkedIn: Jevan Hutson : The Federal Trade Commission requires model deletion for the 8th time! Cambridge Analytica, Everalbum, Kurbo, Edmodo, Ring, Rite Aid, X-Mode … Samuel A.A. Levine : Building on our work to protect geolocation data, health data, and kids' data, today's proposed order against Avast secures new protections for consumers' browsing information. … Joelle Dvir : Another busy day in privacy land! The FTC just announced a $16.5 mil settlement with Avast for selling user browsing data for advertising purposes. … Forums: r/technology : Avast fined $16.5 million for ‘privacy’ software that actually sold users' browsing data r/technology : FTC to ban Avast from selling browsing data for advertising purposes
Context & Ripple Effects
The settlement closes a privacy controversy that had already exposed Avast’s browsing-data business: the company described monetizing browsing habits after browser makers removed some of its tools, and subsequent reporting traced sales through its Jumpshot subsidiary to major clients and other third parties.
It matters because the FTC’s remedy goes beyond a monetary penalty: it removes the advertising-data revenue path at issue. The case sits alongside the agency’s broader effort to constrain companies’ ability to monetize consumer information when their disclosures and permissions do not match practice.
First-order effects
- Avast must pay $16.5 million and stop selling users’ web-browsing data for advertising, ending the conduct alleged by the FTC.
- Users gain a binding restriction on an antivirus vendor’s use of browsing information; advertisers and other third parties lose access to the affected Avast-derived data supply.
Second-order effects
- Security and consumer-software vendors that supplement subscriptions with behavioral-data monetization face pressure to reassess consent language, data-sharing arrangements, and the viability of those revenue streams.
- The order strengthens the FTC’s enforcement playbook for cases where a company’s privacy representations diverge from downstream data sales, following its proposed limits on Meta’s monetization of children’s data.
Third-order effects
- If consistently applied, such remedies could move privacy enforcement from fines toward restrictions on particular data business models, making permission and use limitations more consequential in product design.
- The broader market may place more value on subscription-led security offerings and clearer data governance, though the effect will depend on how broadly regulators pursue comparable cases.
The trend: Privacy enforcement is increasingly targeting the commercial use of behavioral data itself, not only penalizing inadequate disclosures after the fact.