Avast Defends Data Harvesting, Plans to Get Users to Agree to It

Avast will explore “further changes” to its practice of selling users’ browser histories to third-party companies. But in the meantime, the antivirus vendor will try to opt more users into the data-sharing, despite the privacy risks.

On Tuesday, the company published(Opens in a new window) a blog post in response to a PCMag-Motherboard investigation into how Avast’s free antivirus products can expose your website clicks to corporations and market research companies.

Avast defended the data collection as entirely legal. In addition, the company is pressing forward on serving a pop-up window to existing users that’ll ask them to agree to the browser history harvesting.

“We need to analyze data to catch threats,” says an example of the pop-up window, which was included in the blog post. “That’s how an antivirus works.”

But in the same post, the company suggested that Avast is mulling whether it should drop the practice entirely. “While we acted fully within legal bounds, always remaining vigilant to protect our users’ privacy, we have listened to recent feedback and have already taken steps to align with the expectations of our users and continue to consider how a trends analytics service aligns with our values as a cybersecurity and privacy company,” the antivirus vendor said.

The data harvesting has been occurring through Avast’s popular free antivirus products, which have helped the vendor attract 435 million users across the globe. The company claims it can “de-identify” and strip away users’ personal information from the browser history collection process. However, the investigation from PCMag and Motherboard(Opens in a new window) found the same data can actually be analyzed and linked back to a person’s real identity, potentially revealing every website the user visited, including the search terms made.

In Tuesday’s blog post, Avast made no mention of the privacy gaps in the de-identification process. Instead, the company offered a glimpse of how it intends to convince users to opt into the data-collection process.

The example pop-up window claims “This data cannot be used to identify you,” contrary to PCMag’s reporting. It goes on to justify the data collection as necessary for your security while oddly asking for the user’s permission to hand off the same data to the market analytics company, Jumpshot, which Avast owns.

“This funds improvements to your security,” adds the pop-up.

In Tuesday’s blog post, Avast focused on the company’s reasoning to collect users’ browser histories, which occurs through a URL-scanning component that’s been designed to detect and flag malicious websites.

“The cybersecurity world today is powered by data. We use the data from our users’ devices to analyze huge volumes of threat data with machine learning and artificial intelligence, which detects threat patterns and security issues in ways that are impossible for humans unaided,” the company said. “Each month, Avast stops 1.5 billion attempts to attack globally. This conflict is both driven, and solved, by data.”

But in a bit of irony, Avast also decided to sell the same supposedly “de-identified” data to marketers. It’s done so through company subsidiary Jumpshot, which has counted companies like Google, Pepsi, and Turbotax provider Intuit as among its customers.

“The idea was to create an innovative way to provide marketers with trend analytics and statistics on customer purchasing habits that was anonymized, rather than specific user targeting that has been historically pervasive on the web,” the antivirus vendor said.

So far, Avast has offered no specifics on how the company’s de-identification process actually works or which clients it’s sold the collected browser…