According to a report by PCMag who collaborated with Motherboard to investigate Avast, revealed that Avast do harvest users' data and sell to third-party companies for millions of dollars.
Avast, in response, tried to justify the practice with claims that the collected web histories were stripped of users' personal details and can't be used to target users.
"The data is fully de-identified and aggregated and cannot be used to personally identify or target you," Avast said to users who opt in to data sharing. In turn, Avast says it sells these data to online marketers who analyze it to sell more products. It says the data doesn't trace back to users.
Also Read: Hundreds Of Millions Android Smartphones Are Vulnerable To This Camera Hack
However, the researchers says those 'de-identified' data could still be linked back to individuals using the right tools available at the company that the data is being sold to.
"The data collected is so granular that clients can view the individual clicks users are making on their browsing session, including the time down to the millisecond. And while the data is never linked to a person's name, email or IP address, each user history is nevertheless assigned to an identifier called the device ID, which will persist unless the user uninstalls the Avast antivirus product," PCMag said.
Here's an instance of how a single click theoretically look like:
For a normal user, it will be very difficult to pin this data to an individual. However, for big companies like Amazon, pinning the data to an exact user won't be difficult. Amazon will combine the data with their database will be able able to figure out which user bought an Apple iPad pro 10.5-2017 model on 1/12/2019 at 12:03:05.
With that, Amazon will easily figure out who Device ID: abc123x is, and any other information and activity that is on Device ID: abc123x from other e-commerce platforms, web search histories,etc will no longer remain anonymous as claimed.
Apart from the unique identified called device ID, the report also said, Jumpshot, a division of Avast which is responsible for the selling of data do include browsing session timestamps, clicks and as well milliseconds. It also says that Jumpshot has access tot data from over 100 million devices, including PCs and mobile devices.
Also Read: Facebook Is Developing Its Own OS To Challenge Android And iOS
The researchers found out that Jumpshot offers a variety of products for data collection purposes, but has a product dubbed "All Clicks Feed" which collects clicks from users who have installed the Avast browser extension and sells it to a a marketing called called Omnicon Media Group.
Jumpshot do sell the "All Clicks Feed" data without device ID but its contracts to Omnicon includes Jumpshot sending data that contains users device ID linked to each click.
Jumpshot also signed a contract with an Ominion subsidiary called Annalect for All Clicks Feed data for 3 years worth $6.5. The contract covers data from 14 markets, which includes the US, the UK, and India.
The list of Jumpshot clients includes tech giants such as Microsoft, Google and IBM which is a cause for concern since they can be easily used to track users digital footprints.
Avast says that it has stopped collecting data from its browser extension for selling purposes, though the company's Jumpshot division can still users browser histories via Avast's antivirus app on desktop and mobile, and also on AVG antivirus which is owned by Avast.
"We completely discontinued the practice of using any data from the browser extensions for any other purpose than the core security engine, including sharing with Jumpshot," Avast said.