Avast and the FTC: Browsing Data Sold Despite Promises
A privacy tool is only as trustworthy as what it does with the data it sees.
By Siddharth ShankarUpdated October 24, 2026On June 27, 2024 the FTC finalised an order requiring Avast to pay $16.5 million. The FTC said Avast collected users’ browsing information through browser extensions and antivirus software, kept it indefinitely and sold it, through its subsidiary Jumpshot, to more than 100 third parties without adequate notice or consent, while claiming its software would block third-party tracking. The order bans Avast from selling or licensing web browsing data for advertising, requires deletion of data sent to Jumpshot and requires notice to affected consumers.
Your email is the key to most of your accounts. Has it already leaked?
Free · About 30 seconds · No sign-up · Email not stored
People install antivirus software and browser extensions to be safer. This FTC case is a reminder to ask what those tools do with what they see. This guide follows the FTC’s announcement of the final order.
What was announced
The FTC finalised its order with Avast on June 27, 2024. The Commission voted 3-0-2, with Commissioners Melissa Holyoak and Andrew Ferguson not participating, after receiving two public comments. Avast must pay $16.5 million, which the FTC expects to be used for redress to consumers.
What the FTC said Avast did
- Avast Limited, a UK-based company acting through its Czech subsidiary, collected users’ browsing information through its browser extensions and antivirus software.
- It kept the data indefinitely and sold it without adequate notice or consumer consent.
- It sold the data to more than 100 third parties through its subsidiary, Jumpshot.
- The FTC describes the data as detailed and re-identifiable.
The page does not say how many users were affected. It gives only the number of recipients.
The promise at the heart of the case
Avast said its software would protect consumers’ privacy by blocking third-party tracking. The FTC alleged the company deceived users by promising protection from online tracking while failing to adequately disclose that it would sell their detailed browsing data.
Quick check before you read on: is your email in a known data breach? Free, about 30 seconds.
Free · About 30 seconds · No sign-up · Email not stored
What the order requires
Avast and its subsidiaries must:
- not sell, disclose or license web browsing data for advertising purposes;
- delete the browsing information transferred to Jumpshot, along with any products or algorithms derived from it;
- notify consumers whose browsing information was sold to third parties without consent about the FTC’s action;
- obtain affirmative express consent before selling or licensing browsing data from non-Avast products to third parties for advertising;
- implement a comprehensive privacy programme addressing the misconduct the FTC identified.
Why browsing data is sensitive
A record of the sites you visit can reveal your health concerns, finances, politics, job search and more. Even without a name, a detailed browsing history can often be tied to a person. That is why the FTC called this data re-identifiable.
How to pick safer tools
- Read the privacy policy of any extension or security tool, and look at what it says about selling or sharing data.
- Keep extensions to a minimum. Each one can see more of your browsing than you might expect.
- Check permissions. An extension that asks to read and change data on all websites has wide access.
- Prefer products with a clear business model. If a tool is free, ask how it earns money.
- Remove tools you do not use. Uninstall extensions and apps you no longer need.
- Use built-in protections as well. See tracking cookies and Global Privacy Control.
How this fits a wider pattern
The FTC has acted against other companies that collected data in the background and sold it, such as in the X-Mode location data order. Data brokers are the usual destination; see what data brokers are.
Network safety is a separate question
Choosing trustworthy tools is different from choosing a safe network. For public networks, see what the FTC says about public Wi-Fi.
Sources
- FTC: FTC finalizes order with Avast banning it from selling or licensing web browsing data for advertising (June 2024) (allegations, payment, order terms)
Frequently asked questions
How much must Avast pay?
$16.5 million, which the FTC expects will be used for redress to consumers.
What did the FTC say Avast did?
Collected browsing data through extensions and antivirus software, kept it indefinitely and sold it through Jumpshot to more than 100 third parties without adequate notice or consent.
What did Avast promise?
That its software would protect privacy by blocking third-party tracking, according to the FTC.
What does the order ban?
Selling, disclosing or licensing web browsing data for advertising, and it requires deletion of data sent to Jumpshot.
How do I choose safer browser tools?
Read the privacy policy, limit extensions, check permissions and remove tools you no longer use.
See if your email has already leaked
- Checks your email against known data breaches
- Shows which sites leaked it, when, and what leaked
- We do not store the email you check
Compare data removal services
See which services work in your country, what they cost, and the free do-it-yourself route.
Compare removal services →Prefer a one-time report first? Scan My Shadow, our sister service, $9.99.