Vice and PCMag reported that they obtained documents which show how the Avast anti-virus is used to effectively sell more detailed versions of people’s Internet browsing histories.
The data is monetised through an Avast subsidiary called Jumpshot.
According to the reports, Vice and PCMag obtained Jumpshot data that includes web searches on Google, location searches on Google Maps, visits to LinkedIn pages, specific YouTube videos, and interactions on porn websites.
In some cases it is possible to see what search term someone entered on a porn website and which specific video they watched, Vice reported. This data also includes exact timestamps.
While Avast asks permission to collect people’s data, users are not necessarily aware of the extent to which their behaviour is being tracked or their data is being sold.
THANKS to all our Year-in-Review webinar attendees and our live-tweet friends!
Feel free to reach out if you have any questions or comments. And, KUDOS to Jumpshot’s @stephenkraussf and @stevelevay for another fantastic webinar. pic.twitter.com/GkpWOwR3LS
— Jumpshot (@jumpshotinc) December 12, 2019
Within walled gardens
Jumpshot said in a tweet posted on 12 December 2019 that it “delivers digital intelligence from within the Internet’s most valuable walled gardens”.
Its tagline reads: “Every search. Every click. Every buy. On every site.”
Leaked documents reveal that some effort is made to “de-identify” the data. However, linking sensitive information back to an individual would not be particularly difficult for those with the means.
Vice reported that the set of data it obtained with PCMag includes a precise timestamp – to the millisecond – with every URL visited. A company could conceivably see a user visiting their own site, then follow their browsing history using Jumpshot’s data.
Avast provided the following statement:
“Because of our approach, we ensure that Jumpshot does not acquire personal identification information, including name, email address or contact details, from people using our popular free antivirus software.”
Avast said it complies with the California Consumer Privacy Act (CCPA) and Europe’s General Data Protection Regulation (GDPR).
It stated that its users have always had the ability to opt out of sharing data with Jumpshot.
“As of July 2019, we had already begun implementing an explicit opt-in choice for all new downloads of our [anti-virus], and we are now also prompting our existing free users to make an explicit choice, a process which will be completed in February 2020.”