Back in October of last year, Wladimir Palant, the creator of AdBlock plus, discovered that the Avast and AVG Online Security extensions were collecting much more data from its users than he believed to be necessary. He subsequently published a blog post detailing his findings, which are worth reading. According to Palant, the extent of the data being collected and transmitted goes way beyond that of competing solutions like Google Safe Browsing.
Tracking tab and window identifiers as well as your actions allows Avast to create a nearly precise reconstruction of your browsing behavior: how many tabs do you have open, what websites do you visit and when, how much time do you spend reading/watching the contents, what do you click there and when do you switch to another tab. All that is connected to a number of attributes allowing Avast to recognize you reliably, even a unique user identifier.
A day after Palant published his blog post, he was tipped off to the fact that Avast acquired Jumpshot back in 2013. At least according to Avast’s press release at the time, Jumpshot developed a PC performance optimization software that Avast planned to integrate into its own software. However, Jumpshot’s website now markets the company as a “consumer journey analytics” enterprise. Palant came to the conclusion that Jumpshot is likely the destination of the data collected and transmitted by Avast. Jumpshot’s about page doesn’t help assuage any fears:
Jumpshot delivers digital intelligence from within the Internet’s most valuable walled gardens.
In today’s digital economy, more than 70% of online transactions are hidden behind walled gardens. Jumpshot provides insights into consumers’ online journeys by measuring every search, click and buy across 1,600 categories from more than 150 sites, including Amazon, Google, Netflix, and Walmart.
Unfortunately, the blog post did not receive the attention it deserved, so Palant eventually submitted a report to Mozilla developers, who promptly removed the offending extensions. The story picked up traction earlier this week when the PCMag and Motherboard posted the findings of their joint investigation into the matter. Leaked documents confirmed the link between Avast’s data collection and Jumpshot’s analytics.
Yesterday, Avast published a message from the company’s CEO, Ondrej Vlcek, in which he admitted that Avast has been collecting and selling data through Jumpshot. He stressed Avast’s commitment to providing security and announced the following:
I – together with our board of directors – have decided to terminate the Jumpshot data collection and wind down Jumpshot’s operations, with immediate effect.
Avast published another press release today giving more details concerning the shuttering of Jumpshot, with a further statement from the CEO:
We regret the impact this will have on Jumpshot employees and we appreciate the contributions they have made. We will endeavor to make this transition as smooth as possible for them.
Our Editorial Process
Our Editorial Process
Share
Question & Answers (6)
Leave a Reply
Nathan Wasson
Former Gaming & Tech Journalist
Avast is more of a Spyware than an Anti Virus. I stopped using it years ago and never looked back. For free Anti Virus there is Kaspersky Security Cloud for paid one ESET NOD32 which is the lightest yet pretty strong in protection.
Hmmm, I count on those analytics to do my grunt work and bring me the tailored ads for my work machine and my wife’s fluff for our home PC. What good is a probing invasive terminator if you cant get him to go pick up your laundry?
Avast IS the virus. I only needed to take one look at the program and it’s impact on a system (back in the days of HDDs) to know I never wanted it on my system.
Still, I would not have expected it to gather such detailed data.
That is nonsense.
Avast has had better detection rates, low false positive rates and lower impact on system performance than Windows Defender in pretty much any test you can find.
The collection of data is what that user agrees to. So any competent user that wants to use it will have blocked this in their firewall. Same applies to Windows 10 which has several components that also phone home…
Any user competent enough to specifically prevent an application from sending mined data doesn’t need a virus scanner in the first place. Virus scanners are primarily to help people who don’t otherwise have the experience to recognise reliable software sources, and who don’t know what an executable file is, and not to click it when someone emails one to you.
Free virus scanners, along with any other free-commercial software, trade on the knowledge that most people using it won’t understand that their data is being mined, and won’t know to take measures to prevent it.
Pretty much tallies with what my thoughts have been on the matter for over a decade now.
If you don’t want the security of your computer compromised, *never* use a free virus scanner.
As usual with any free-but-not-open-source software… if you aren’t paying for it, you aren’t a customer, and if you aren’t the customer, you’re the product.