Avast busted: FTC orders $15.3M payout over privacy violations

The Federal Trade Commission (FTC) is handing out $15.3 million to more than 100,000 consumers affected by deceptively marketed antivirus software from Avast.

Avast, a Czech multinational cybersecurity software company, promises to protect internet users’ privacy with its browser extensions, preventing data brokers and other data collectors from collecting personal and privacy-sensitive information.

Avast was referring to personal information, such as browsing history, search queries, geolocation, and online purchases, as well as sensitive data, including sexual orientation, religious beliefs, trade union membership, and political party affiliation.

However, Avast did exactly the opposite of what it promised. Through its subsidiary Jumpshot, which was acquired in 2013, the antivirus maker sold customer data to tech companies such as Google, Microsoft, and Yelp. However, this was done without the consent of its users since at least 2014, which infringes the General Data Protection Regulation (GDPR).

Last year, Avast reached a settlement with the FTC over the unfair collection and sale of user data. The antivirus company promised to pay $16.5 million in damages. In addition, Avast is required to provide redress to consumers and is prohibited from selling or licensing web browsing data for advertising purposes.

“Avast promised users that its products would protect the privacy of their browsing data, but delivered the opposite. Avast’s bait-and-switch surveillance tactics compromised consumers’ privacy and broke the law,” Samuel Levine, Director of the FTC’s Bureau of Consumer Protection, said in a statement at the time.

Earlier this year, the FTC sent an email to 3.7 million customers who purchased Avast between August 2014 and January 2020. Customers were then able to submit a compensation claim.

According to the FTC, 103,152 Avast users submitted valid claims. The $15.3 million will be distributed among them, which amounts to an average compensation of around $150 per user.

All affected victims should receive their financial compensation within 90 days.

Unlock more exclusive Cybernews content on YouTube.