Beware of what you're opting into when installing free antivirus software

(Image credit: Pixabay (mohamed_hassan))

Avast is a name that inevitably comes up when discussing free antivirus software, and with good reason—the company claims it has over 435 million users, making it one of the most popular AV options around. Avast's reputation is under fire, however, following a joint investigation by Motherboard and PCMag into the extent it sells opt-in user data to third parties.

According to the reports, leaked documents highlight the "secretive sale" of internet browsing histories and activities to a subsidiary called Jumpshot. That information is then packaged and sold, with Google, Yelp, Microsoft, Pepsi, Home Depot, and others among some of the bigger past, present, and potential clients. In some cases, clients paid millions of dollars for an "all clicks feed," which includes website tracking data, clicks, and detailed accounts of movement across sites, according to the report.

This only happens when users who install the free antivirus software opt into having their data collected. The data is also anonymized, so it does not include names, email addresses, or IP addresses (though each history is assigned a device ID). So, what's the big deal?

Motherboard says it viewed data that included Google searches, GPS coordinates, people visiting LinkedIn pages, YouTube histories, and porn site visits. The site also said it is possible to know the dates and times of particular visits to websites, and what specific videos they watched on, say, PornHub. Moreover, "experts" told Motherboard it would be possible to de-anonymize the data in some cases.

"I was not aware of this," a user of the free Avast antivirus software told Motherboard. "That sounds scary. I usually say no to data tracking."

"Because of our approach, we ensure that Jumpshot does not acquire personal identification information, including name, email address or contact details, from people using our popular free antivirus software," Avast said in a statement.

"Users have always had the ability to opt out of sharing data with Jumpshot. As of July 2019, we had already begun implementing an explicit opt-in choice for all new downloads of our AV, and we are now also prompting our existing free users to make an explicit choice, a process which will be completed in February 2020," Avast added.

The lesson for us is an old one: If you don't have to pay for commercial software, then it's likely that the customer is someone other than you—possibly someone who wants your data. Always read the fine print before opting in to anything. It may not go into the type of detail that these reports do, but err on the side of caution.

Paul has been playing PC games and raking his knuckles on computer hardware since the Commodore 64. He does not have any tattoos, but thinks it would be cool to get one that reads LOAD"*",8,1. In his off time, he rides motorcycles and wrestles alligators (only one of those is true).