The U.S. Federal Trade Commission (FTC) fined Avast $16.5 million. The agency said Avast collected and sold users’ browsing data without proper notice. Avast had marketed its antivirus tools as a way to stop online tracking. Instead, according to the FTC, Avast tracked its own customers and sold that information for profit.
How Avast tracked and sold user data
Avast collected browsing data through its antivirus software and browser extensions. This happened from at least 2014 through 2020, the FTC said. The data included web searches, visited pages, and timestamps. It also included device details, browser information, and location data. Location data has also drawn major privacy enforcement elsewhere, including a €403 million (over $450 million USD) fine against Google in Ireland for location data privacy violations.
Avast then sent this data to its subsidiary, Jumpshot. Jumpshot sold the data to more than 100 outside companies, according to the FTC. Many of these buyers used the data for advertising and research.
The FTC also challenged Avast’s claims about keeping the data anonymous. Some data sold by Jumpshot carried a unique code tied to each browser. That code sat alongside a person’s browsing habits, device type, and location. Buyers could use this code to match browsing activity to real people, the agency said.
The scale of the operation grew large over time. FTC filings show Jumpshot held more than 8 petabytes of browsing data by January 2020. Some records stretched back to 2014. One advertising company alone received data covering half of Avast’s users in several countries, the FTC noted.
The story became public in January 2020. Motherboard and PCMag ran a joint investigation into leaked Jumpshot documents and contracts. Reporters found that Jumpshot had sold detailed browsing data to major firms. Avast shut down Jumpshot soon after the story broke.
FTC’s final order and penalty
The FTC finalized its order against Avast in June 2024. Avast must pay $16.5 million as part of the settlement. The company can no longer sell or license browsing data for advertising, according to the FTC’s final order.
Avast must also delete the browsing data it sent to Jumpshot. This includes any tools or algorithms built from that data. The full consent order lays out these requirements in detail.
The penalty did not end there. The FTC began sending refunds to eligible customers in December 2025. The agency paid nearly $15.3 million to 103,152 people who filed valid claims, according to the FTC’s refund announcement.
It is worth noting that Jumpshot shut down back in 2020. The FTC’s order now blocks Avast from running the same type of operation again. The case does not suggest that Avast still sells this kind of data today.
Social media reacts to the case
News of the fine spread widely on X, with many users pointing out the irony. One user, going by T3chFalcon, said Avast had turned into the very thing it promised to stop, becoming a tracker while claiming to fight trackers. Another user, liberdus, made a similar point, saying Avast cut out the middlemen and simply became the tracker itself.
Not every reaction stayed focused on the FTC’s actual findings. A user named Alpine_Hermit raised separate concerns about Avast’s later ownership links and its CCleaner product. However, those claims fall outside the scope of the FTC’s case and remain unconfirmed by the investigation.
Another user, Sounsmooth, argued the full story might involve other forms of data collection. They called the overall situation unclear. That comment highlights why the confirmed FTC findings matter most. The documented case centers on Avast’s browsing data collection through Jumpshot, nothing broader than that.
For now, the Avast case stands as one of the largest privacy enforcement actions tied to a security company. It shows how a tool meant to protect user privacy instead became part of a large data sale operation.
