It’s among the oldest adages in tech, the one about that product you think is free not really being free at all — that you, in fact, are the product in those cases. The manifestation of that truism this time comes in the form of Avast and its subsidiary AVG, which offer popular antivirus products and which are in hot water at the moment over a new report that blasts the company for sharing your browsing history with major corporations.
The report comes via a joint investigation by PCMag and Motherboard detailing how the data that users opt-in to share, which purportedly is anonymized to mask their individual identities, includes granular insights that could help companies like Google and Microsoft learn a lot about you. Among the many ways this can happen, according to the investigation, is the scale at which this data is being collected, including Avast tracking user clicks “down to the second.”
The data doesn’t flow directly from Avast’s hands to the companies that obtain it. Avast has a subsidiary called Jumpshot through which the former markets data from users to companies like Google. Per ExtremeTech, here’s an example of the user data available:
Device ID: abc123x Date: 2019/12/01 Hour Minute Second: 12:03:05 Domain: Amazon.com Product: Apple iPad Pro 10.5 – 2017 Model – 256GB, Rose Gold Behavior: Add to Cart
That might look meaningless to you, but if you’re Amazon, all you’d need to do (if you actually wanted to bother to do this on an individual level, of course), is trawl your archives for whoever performed those actions at the same time on the same day.
Avast’s Chrome extensions no longer enable user tracking, but that’s not the case with the desktop programs that still collect user clicks. The new report published about this user tracking builds on a similar investigation published late last year by Wladimir Palant, the creator of Adblock Plus who used it as the basis to declare that Avast and AVG were spying on users. And it’s unfortunate, mostly because of the expectation with an antivirus product that it’s protecting you — whereas, in this case, even though Avast has told users who opt-in that “The data is fully de-identified and aggregated and cannot be used to personally identify or target you,” marketers and other big companies still can conceivably use this to get their hands on tons of your clicks that you never expected someone else would end up seeing.
