The US Federal Trade Commission recently announced a $16.5 million settlement with UK-based software provider Avast Limited, its Czech subsidiary Avast Software s.r.o., and its US-based wholly-owned subsidiary Jumpshot, Inc. (collectively “the respondents”) to resolve allegations that they had violated the Federal Trade Commission Act. According to the FTC’s complaint, since at least 2014, the respondents engaged in a scheme to sell and distribute antivirus software that they claimed would protect consumers from online tracking. However, according to the FTC, the respondents used the software to collect consumers’ detailed, re-identifiable browsing information, which it stored indefinitely. The FTC further alleged that Jumpshot, whose operations were closed in January 2020, sold the browsing data to more than 100 third parties, including advertising, marketing and data analytics companies, without providing consumers with adequate notice or obtaining their consent. The data that was allegedly collected through the software included financial information and certain sensitive data, such as information related to consumers’ religious beliefs, health concerns and political leanings.
In a 3-0 vote, the Commission voted to issue the administrative complaint and accept the proposed consent agreement. The settlement prohibits the respondents from selling or disclosing the collected browsing information to third parties for advertising purposes without first obtaining consumers’ affirmative express consent. As part of the settlement, the respondents were also ordered to delete any browsing information transferred or used by Jumpshot; inform consumers whose data was sold to third parties without their consent; and implement a comprehensive privacy program that addresses the misconduct identified by the FTC. In order to ensure respondents’ compliance with the proposed order, a third-party assessment of the respondents’ mitigation efforts must be reported to the FTC within 180 days of the order’s issuance and every two years thereafter for a period of 20 years.
The proposed consent agreement will be published in the Federal Register and will be subject to public comment for 30 days before the Commission decides whether or not to finalize the order.
FTC Press Release | FTC Consumer Alert | FTC – Avast Case Summary | Complaint | Proposed Decision and Order