Documents reveal that Avast has sold its users' internet browsing data, through a subsidiary called Jumpshot, to clients like Pepsi, Google, and Microsoft
An antivirus program used by hundreds of millions of people around the world is selling highly sensitive web browsing data …
VICEJoseph Cox
Context & Ripple Effects
This story closes a loop that opened weeks earlier, when Forbes reported Avast had been monetizing its users' browsing habits since 2013 after Mozilla and Opera pulled its tools from their add-on stores. The new documents go further than the earlier explanation: they name the buyers — Pepsi, Google, Microsoft — and show the data flowing through Jumpshot, a marketing subsidiary inside an antivirus company trusted with hundreds of millions of machines.
The aftermath in the related coverage gives the arc its shape: Avast shut down Jumpshot within days of the revelations, data broker Hitwise collapsed after allegations it bought the same feed, and four years later the FTC forced a $16.5M settlement and a permanent ban on selling browsing data for ads. The precedent stretches back to 2015, when sister company AVG updated its privacy policy to sell anonymized user data with an opt-out.
First-order effects
Named clients Pepsi, Google, and Microsoft are revealed as purchasers of browsing data harvested from antivirus customers, putting their own data-procurement practices under scrutiny at the moment of publication.
Avast's core value proposition — free security software funded by something other than user data — is directly contradicted by the documents, threatening the trust base of a product installed on hundreds of millions of devices.
Second-order effects
Mozilla and Opera's earlier removals of Avast tools from their add-on stores become the template for platform gatekeepers policing how extensions monetize user behavior.
Buyers of the Jumpshot feed inherit the reputational damage: Hitwise, a 24-year-old consumer insights firm alleged to have purchased the same sensitive data, shuts down entirely rather than ride out the controversy.
Third-order effects
The FTC's eventual $16.5M penalty and prohibition on selling browsing data for ads establishes that misrepresenting telemetry use carries not just a fine but a structural business-model ban — security vendors cannot treat device-level visibility as a data asset.
The pattern from AVG's opt-out policy through Jumpshot to the settlement suggests regulators will treat 'anonymized' behavioral data sold by trust-positioned software as a deception problem, pushing the entire freemium-security category toward subscription funding.
The trend: Consumer trust products monetizing behavioral telemetry are being forced out of the data-brokering business by platform removals, buyer contagion, and ultimately regulator bans on the practice itself.
New: leaked documents, data, contracts show how hugely popular antivirus Avast now harvests internet browsing data and sells it for millions of dollars. Clients included Home Depot, Google, Microsoft. Documents show a product called “All Clicks Feed” https://www.vice.com/...
SCOOP: Leaked documents show that the world's largest companies, including Google, Microsoft, McKinsey, Bain, Altria, etc. are spending millions tracking your every click around the internet: https://www.vice.com/...
In short, Avast collects the data by its antivirus product being installed on peoples' computers. It then provides that data to its subsidiary Jumpshot, which then sells products based on the data to clients https://www.vice.com/... https://twitter.com/...
Companies LOVE to pretend that “anonymizing” your data somehow means users can't be identified or their data abused. These duo reports do a lovely job highlighting how that's nonsense: https://www.pcmag.com/... https://twitter.com/...
I mean telecom has been doing this sort of thing for years, but you'd think we'd at the very least hold “security” software to a higher standard. Nope. There is no privacy. https://twitter.com/...
Been using free antivirus software? Your very, *very* detailed browsing history has been put on the market - and lots of companies have been eagerly buying it. If you're not paying (and sometimes when you are), you're the product, not the customer. https://twitter.com/...
Avast is harvesting users' browser histories and selling the data to other companies without fully “de-identifying” it. The data can be linked back to people's real identities, exposing every click and search they've made: https://www.pcmag.com/... https://twitter.com/...
Avast and AVG antivirus tell you your privacy will be protected. However, no mention is made about how your “de-identified” data can be combined with other information to identify you. https://www.pcmag.com/... https://twitter.com/...
Avast's subsidiary Jumpshot sells companies access to user traffic from 100 million devices. These companies can view the individual clicks users are making on their browsing sessions, including the time down to the millisecond. https://www.pcmag.com/... https://twitter.com/...
This piece on Avast browsing data selling was a collaboration between Motherboard and PCMag. In their own piece, PCMag goes more into how the data could be de-anonymized. The outlet has now also pulled Avast from its recommendations of free antivirus https://www.pcmag.com/... htt…
This is the new opt-in message that should be popping up on more Avast antivirus users' screens soon. It arguably isn't clear on what Jumpshot really does with this data: collect browsing history which can see what site you were on at what time, sells it https://www.vice.com/... …
This is another reason why quitting these services is futile. Their power is so far beyond our standard ways of dealing with companies. https://twitter.com/...
Am I the only one who didn't know Avast is Jumpshot? Seriously, check their website. Not a *single* mention of Avast as the data source. lol that's incredible. https://twitter.com/...
Detail on Avast's collection of users' web habits. If you didn't know about this already, read it. This is how the CEO responded to my questions on the issue in December, which led to @RonWyden writing to Avast to ask what was going on: https://www.forbes.com/... https://twitter.…
And selling this browsing data is big business. A Jumpshot contract we obtained showed sales of browsing data for over $2,000,000 a year, to just one client. https://www.vice.com/... https://twitter.com/...
There are only two reasons in the world to produce, distribute and maintain free software: 1. It's a project you really believe in, and 2. To do things like this with the data. https://twitter.com/...
The antivirus business doesn't make much money anymore, so software like Avast is selling your browsing data instead. Don't use third-party antiviruses, people. 😬 https://www.vice.com/...
For the last time... If you have Windows, use Windows Defender (which comes installed). Stop using Avast, AVG, Symantec, Cylance, or any of these third rate data leeches for virus protection. https://twitter.com/...
Here is the description of the All Clicks Feed from an internal document. Data taken from users of Avast antivirus, put into this product, and then data provided to clients in granular detail. “All Clicks Feeds will let you see all of the activity.” https://www.vice.com/... https…
Was taken aback by the bluntness of Avast/Jumpshot's internal documents on its sale of users' browsing data. “The data set is almost like an Apache log for the entire Internet for every device in the panel.” https://www.vice.com/... https://twitter.com/...
Speaking of things which need regulation.. “The data set is almost like an Apache log for the entire Internet for every device in the panel.” https://twitter.com/...
Last year Avast was caught harvesting users' browsing data through its browser extensions. Google, Mozilla, etc removed them. But we've found through leaked documents + other info that the collection hasn't stopped. It now happens through the AV itself https://www.vice.com/... ht…
Before selling the data Jumpshot/Avast removes personal info like names. But multiple experts believe you could identify people inside it. The data itself is also highly sensitive, being able to see specific porn videos and searches people looked at https://www.vice.com/... https…
An antivirus company sells the ultimate in user behavior data: ‘Every search. Every click. Every buy. On every site.’ Its buyers? Google, Microsoft, McKinsey, Pepsi and a whole lot more. https://www.vice.com/...
NEW: Leaked docs show some of the world's biggest companies buying highly granular data on web browsing—the kind that could be used to identify individuals—from Avast, the antivirus company https://www.vice.com/... https://twitter.com/...