The UK's CMA says NortonLifeLock's $8.6B Avast acquisition could result in customers getting a worse deal and asks the companies to submit remedy proposals
U.S. cybersecurity firm NortonLifeLock Inc's $8.6 billion purchase of rival Avast Plc (AVST.L) will face an in-depth probe by Britain …
Context & Ripple Effects
NortonLifeLock's pursuit of Avast began with advanced merger talks in July 2021 and was formalized a month later as a cash-and-stock deal worth between $8.1B and $8.6B. Britain's Competition and Markets Authority has now escalated to an in-depth Phase 2 probe, worried the combination of two of the biggest consumer antivirus brands would leave UK customers with a worse deal.
The arc that follows is instructive on both sides: by August 2022 the CMA executed a U-turn and provisionally cleared the merger, citing significant competition from McAfee and others, while separately the US FTC later forced Avast to pay $16.5M and stop selling web browsing data for ads. This March 2022 probe is the moment the deal's fate genuinely hung in the balance.
First-order effects
- NortonLifeLock and Avast must each submit remedy proposals — structural fixes or conduct commitments — to persuade the CMA the merger preserves competition, putting the deal timeline and terms under direct regulatory control.
- UK consumers of Norton and Avast security products are the named beneficiaries if the CMA blocks or conditions the deal, since the regulator's stated concern is higher prices or reduced choice.
Second-order effects
- McAfee and other consumer-security rivals become the load-bearing argument: their competitive strength is what the merged company will cite in its remedies and what ultimately justified the CMA's provisional clearance, making rivals' pricing behavior evidence in the case.
- A blocked or heavily conditioned deal would have pushed NortonLifeLock back toward standalone growth and left Avast, a London-listed target, exposed to a discounted valuation — the dynamic behind the 43% share jump when clearance came.
Third-order effects
- The probe sits inside a broader CMA campaign against large tech acquisitions — it opened a parallel investigation into Microsoft's planned $16B Nuance purchase months earlier — signaling that US buyers of UK-listed tech targets face mandatory deep scrutiny rather than rubber stamps.
- Regulators are converging on consumer-security firms from two directions at once: competition authorities on pricing power and privacy enforcers on data monetization, raising the compliance bar for any consolidation in the category.
The trend: Consumer cybersecurity is consolidating into fewer, larger brands even as UK and US regulators test how much scale the market will tolerate before intervening.