FTC Finalizes Order with Avast Banning it from Selling or Licensing Web Browsing Data for Advertising and Requiring it to Pay $16.5 Million

The Federal Trade Commission has finalized an order banning software provider Avast from selling, disclosing, or licensing any web browsing data for advertising purposes to settle charges the company and its subsidiaries sold such information after promising that its products would protect consumers from online tracking. The company also must pay $16.5 million, which is expected to be used to provide redress to consumers.

In a complaint, first announced in February, the FTC alleged that UK-based Avast Limited via its Czech subsidiary, unfairly collected consumers’ browsing information through the company’s browser extensions and antivirus software, stored it indefinitely, and sold it without adequate notice and without consumer consent. The FTC also charged that Avast deceived users by claiming that the software would protect consumers’ privacy by blocking third party tracking, but it failed to adequately inform consumers that it would sell their detailed, re-identifiable browsing data. The FTC alleged Avast sold that data to more than 100 third parties through its subsidiary, Jumpshot.

Under the order, Avast and its subsidiaries also must delete the web browsing information transferred to Jumpshot and any products or algorithms derived from that data; must obtain affirmative express consent from consumers before selling or licensing browsing data from non-Avast products to third parties for advertising purposes; notify consumers whose browsing information was sold to third parties without their consent about the FTC’s actions against the company; and implement a comprehensive privacy program that addresses the misconduct highlighted by the FTC.

After receiving two comments, the Commission voted 3-0-2 to give final approval to the settlement. Commissioners Melissa Holyoak and Andrew N. Ferguson did not participate.