Updated January, 30 2020: This article has been updated to reflect that Sephora is not a past, present, or potential client of Avast/Jumpshot.
What you need to know
- A report by Vice and PCMag alleges that Avast sells web browsing data to several large companies.
- Avast sells data to a subsidiary named Jumpshot that works with these companies.
- While the option to share data is opt-in, the option does not specify how the data will be used.
A joint investigation by PCMag and Vice's Motherboard states that Avast sells people's browser data to large corporations through a subsidiary named Jumpshot. The report relies on leaked user data, contracts, and company documents that indicate the sale of data. Jumpshot's past, present, and potential clients include Google, Yelp, Microsoft, McKinsey, Pepsi, Home Depot, Condé Nast, and Intuit, according to Vice. Sephora reached out to use to clarify that it is not a past, present, or potential client of Avast/Jumpshot.
Vice's report goes into great detail, but the quick version is that according to Vice, Avast collects user data, sells it to a subsidiary named Jumpshot, and then Jumpshot sells the data to companies that can use the information to optimize marketing efforts. Some examples of data that Motherboard and PCMag obtained include Google searches, lookups of locations, which LinkedIn pages and YouTube videos people looked at, and what porn websites people view. The data is anonymized, however, and Avast claims that it can not be traced back to a specific individual.
Avast has over 435 million active users per month, though Jumpshot only has data from 100 million devices. That's because data collection is now an opt-in option for people. Though, many people told Motherboard that they weren't aware of opting in. While many people skip through the terms and conditions of things they agree to, it's worth pointing out that while the opt-in process discusses Jumpshot using the data, it does not explicitly explain how data will be sold to companies.
A source told Motherboard that the data gained through this process is valuable to companies because how detailed it is; "It's very granular, and it's great data for these companies, because it's down to the device level with a timestamp."
Avast used to have a browser plugin that warned users of suspicious websites. It also harvested data from users, as reported by Wladimir Palant. Following that report, Mozilla, Opera, and Google removed Avast's extensions from their browsers. But even without the plugin, Avast can collect user data through its anti-virus software. A Motherboard source and documentation found by Motherboard indicate that Avast's collection of data continues even after the plugins' removal. Avast's software now asks users to opt-in to data collection.
Jumpshot has several packages of data that it sells to companies. One package includes an "All Click Feed." This includes all clicks performed on a specific domain. For example, a company could purchase all of the clicks performed on a retail website to gain insight into buying habits. Jumpshot itself advertizes the ability to track "every click" and "every buy" in a recent tweet.
