FTC fines cybersecurity company Avast $16.5 million for tracking and selling user data

The FTC says Avast, a firm that promises to protect consumer data from online tracking, has done the opposite, collecting and selling user browsing data without knowledge or consent while simultaneously misleading users.

Avast’s origins date back to the late 1980s, when its founders lived and worked in Czechoslovakia when it was part of the Soviet Bloc. The company grew its antivirus software and other offerings over time, went public and merged with other companies in the cybersecurity space over time.

Avast is now one of several brands owned by Gen Digital, a publicly-traded company with dual headquarters in Tempe, Arizona, and Prague in the Czech Republic.

In the complaint, the agency says Avast Limited, based in the United Kingdom and through its Czech subsidiary, claimed to block tracking cookies that collect data and prevent other trackers from following online activity only to then sell that data to third-parties, engaging in the behavior since at least 2014.

Furthermore, the FTC says Avast told users it would only share information in “anonymous and aggregate form,” though this was not the case.

“A person’s browsing history can reveal extraordinarily sensitive information. A record of the websites someone visits can divulge everything from someone’s romantic interests, financial struggles, and unpopular political views to their weight-loss efforts, job rejections, and gambling addiction,” FTC chair Lina Khan said in a statement Wednesday.

“The FTC charges that Avast’s conduct here was not only deceptive, but also an unfair practice,” Khan went on. “Because it is intrinsically sensitive, browsing data warrants heightened protection.”

The FTC says Avast sold data to a range of over 100 clients, including consulting firms, advertising companies and data brokers.

On top of the multi-million dollar fine, Avast is being hit with a ban from the FTC to prohibit the company from selling or licensing data for advertising purposes.

“Avast promised users that its products would protect the privacy of their browsing data but delivered the opposite,” Samuel Levine, Director of the FTC’s Bureau of Consumer Protection, wrote in a release Thursday. “Avast’s bait-and-switch surveillance tactics compromised consumers’ privacy and broke the law.”

Avast did not respond to CNN’s request for comment.

The-CNN-Wire™ & © 2024 Cable News Network, Inc., a Warner Bros. Discovery Company. All rights reserved.