Leaked documents expose Avast antivirus subsidiary selling web browsing data
vice.com
vice.com
Blocklisting the extensions would disable existing installations and stop ancillary data collection, which is prohibited by Firefox Add-on Policies.
https://extensionworkshop.com/documentation/publish/add-on-p...
> Mozilla expects that the add-on limits data collection whenever possible, in keeping with Mozilla's Lean Data Practices and Mozilla's Data Privacy Principles, and uses the data only for the purpose for which it was originally collected.
There are a number of browser extensions maintained by antivirus companies that use security as a disguise to collect and monetize user data. It is time for Google and Mozilla to act on this issue and protect users from these predatory practices.
Benign extensions that are genuinely useful and don't have a company behind them do not get this treatment [1], they are blocked whitout preliminary contact with developers [2].
[1] https://www.jeremiahlee.com/posts/page-translator-is-dead/
[2] https://www.ghacks.net/2019/11/05/mozilla-bans-all-extension...
I am the lead dev for a relatively small Firefox extension. We do not do ANY tracking.
We were rejected and removed for simply including the sdk for Microsoft outlook addins as a script in one of our html pages (we share the codebase for an outlook addon as well). This script is well documented and published by Microsoft.
I find the hypocrisy here staggering.
I know that Firefox gets a lot of love, particularly on HN because it feels like Mozilla is still a trustworthy company. I want to clearly express that I no longer believe this. They want addons in the store that they can use for marketing and sales. Period.
This article, along with some other sites and my own digging made me leave Firefox for good. It's a good read if you value privacy and think Mozilla is the good guy in a field dominated by evil corporations. At first it might seem biased, but the author makes very good points and backs them up with tons of sources that can't be really argued - most of the article is reviewing privacy policies and terms of service agreements that are available publicly to check.
For now I stuck with Pale Moon, but I'm considering some other browsers like Ungoogled Chromium for my daily private and work use. Pale Moon feels kinda janky and old-school in a not good way. But it's fast and (with some minor tweaking: https://spyware.neocities.org/guides/palemoon.html) respects your privacy 100%.
They spend most of the introduction ranting about browser features being removed in updates - because their expectation seems to be that once Mozilla ships a feature, it must forevermore be a part of the latest version of the browser, from now, until the heat death of the universe...
Disclaimer: I don't actually use Firefox, I don't have a hobby horse in this race.
We tried to understand this bizarre no-modifying-third-party-libraries policy and see how we could fix it, but they stopped responding and eventually even deleted our extension from the browsers where our users had previously installed it. (Even Apple doesn't do this when it yanks apps — only rarely if there is proven bad behavior will the pull an already-installed/paid-for app from a device.)
I happen to know a couple very high-up people at Mozilla, and one of them was able to flag our mistreatment, and the reviewers now seem to be walking back the previously-described global ban on modifying third-party libraries, but we're still not back in the addon store (it's been months).
The (alleged?) policy makes no sense to me, and I also don't understand why Mozilla is now blocking users from installing any addon that hasn't been blessed by Mozilla. I understand that they want to vet addons that are listed in their store, but they've assured me that users can't even install off our website unless Mozilla signs off. That seems very un-Mozilla-ish to me. What happened to the open web?
For the record, I used to love Mozilla/Firefox, and have used their browsers for decades. I now use Brave, both because of experiences like this one, and because it's much faster on my Mac.
The most charitable explanation I can come up with is that they want to avoid confusion attacks on their reviewers. But then again they already have a list of hashes for trusted libs, so clearly they could just diff the modified library against the canonical version when a hash doesn't match.
> but they've assured me that users can't even install off our website unless Mozilla signs off. That seems very un-Mozilla-ish to me. What happened to the open web?
I have clashed with their addons staff over similar issues. Their argument is basically security absolutism, motivated by (some) users easily being tricked. Any inch of rope you give the user they will use to hang themselves. So any security-related decisions they make are based on this dumbest possible user. Additionally they consider it a reputational issue, if an extension screws up firefox then firefox is blamed, or so they say.
Firefox stable basically means nannying. If you want more control you're supposed to use developer edition or (on linux) the distribution builds. They don't say it quite that directly, but that's what their answers boil down to.
Honestly, most of the people I know who use FF these days are pretty tech-savvy. This wasn't always the case — my mom used to use Firefox. But Chrome/Safari/Edge are the default browsers these days, and they're pretty good. The only people installing other browsers are either pretty savvy, or being helped out by people who are savvy.
I realize that Mozilla perhaps yearns of the days when they had much larger market share (and therefore many more easily-tricked users). But those days seem to have passed.
Likewise, they may be trying to position themselves to become the go-to browser for the unwise masses. And perhaps someday they will retake that crown. But in the meantime, these nanny-state restrictions piss of their developer-heavy base.
This is how the Avast blocklisting request should have been handled:
- Immediately blocklist [1] the extension because it harvests personal data without user consent, notify Avast
- Offer to reenable the extension for the existing user base when Avast reaches out and stops data collection in an extension update
Because the extension was not blocklisted, but temporarily removed from the store, personal data was siphoned off without the consent of existing users for weeks, with the knowledge and implicit approval of Mozilla, until Avast has released an update.
Users that have configured Firefox to update extensions manually may continue to use an extension version which steals personal data, despite Mozilla being capable of disabling those extension instances, and despite their recent commitment [2] to use blocklisting more proactively when an extension is circumventing user consent or control.
Mozilla did not respect its own policies and has put the interests of Avast before the privacy and safety of its users.
[1] https://blocked.cdn.mozilla.net
[2] https://blog.mozilla.org/addons/2019/05/02/add-on-policy-and...
The initial update for one extension was also approved despite the extension not respecting a declined consent and resuming data collection after browser restart [1].
Ultimately we need to give the user more control over what software on their system is doing. None of these entities (mozilla, google, apple, microsoft, amazon, facebook) can be trusted to act in our best interest
It has been taken down occasionally, mostly months after the last version got released.
What annoys me most is that this happens out of the blue. There is no „pre-warning“.
The last times this happened, we told our customers to use Chrome instead. Never had a problem with them.
But if the takedown really happens months after the last update, then that would mean malicious add-ons are left on AMO for months?
...clients include Google, Yelp, Microsoft, McKinsey, Pepsi, Sephora, Home Depot, Condé Nast, Intuit, and many others.
It is possible to determine from the collected data what date and time the anonymized user visited YouPorn and PornHub, and in some cases what search term they entered into the porn site and which specific video they watched.
Although the data does not include personal information such as users' names, it still contains a wealth of specific browsing data, and experts say it could be possible to deanonymize certain users.
John Oliver, in his work on the NSA scandal had Snowden explain individual NSA programs based on "dick picks", to help people visualize and clarify the consequences of what otherwise is just generically described as "selling/stealing your data".
I remember this being the opposite - for nude pictures instead of porn preferences at least.
Avast did a study where 77% of US respondents said that between nude pictures and financial data they would rather have nude pictures of them leaked[0].
Maybe it's because financial data is directly tied to one's well-being but except for certain professions nude photos aren't.
Then again nude photos aren't necessarily the same as porn.
[0] https://thenextweb.com/insider/2015/11/17/study-smartphone-u...
Could a malicious actor create a blackmail-bot? It wouldn't even need to be that great - just something a little more believable than the "I took over your computer and videoed you masturbating" spam.
Could more subtle, targeted blackmail operation involve this data? There is a lot of this sort of thing in politics.
We know PIs, bail-bonders and other folks on the fuzzy LE/commercial coercion industry line were heavy users of realtime cellphone tracking. I imagine the more creative ones have considered the value of these data pits, too.
> Some past, present, and potential clients include...
Keyword "potential".
Although, the subtitle does say
> Its clients have included Home Depot, Google, Microsoft, Pepsi, and McKinsey.
[1] https://palant.de/2020/01/27/avasts-broken-data-anonymizatio...
[1] "Jumpshot Knows What You're Buying, Browsing, Searching" https://www.cmswire.com/digital-marketing/jumpshot-knows-wha...
I emailed some journalists about Jumpshot a few years back. It’s good that everyone now understands what is going on.
If you had told me five years ago that I would stand up exfil monitors on my home network because commercial and criminal surveillance was so pervasive, I would have said that would be crazy talk. And yet here we are.
Basically, DNS logging forwards to a daemon I wrote that detects Base64/UU/other encodings in DNS requests and asks the network manager[1] to shut off connectivity to the client asking such questions. There is a volume-of-queries timer, and I have some other ideas to add to it.
I'm working on a TLS-inspecting proxy with squid and sslsplit, as I expect there's a lot to look at. I very much want to know if something emits any of various magic numbers - SSN, bank account numbers, address book entries, IMEIs, etc.
As far as more general blocking, I use parts of Pihole, which merges with some other data sources, to defeat DNS resolution for folks I don't want on my internet. And I use Maxmind's geoip data to generate iptables rules to block most of the world on public facing infra - my tiny user base is not in most of it.
[1] I use Unifi gear, this will do you no good if you don't: https://github.com/Art-of-WiFi/UniFi-API-client
EFF's analysis of Amazon Ring egress traffic mentions some possibly useful tools for inspecting SSL/TLS traffic. Specifically: mitmproxy and Frida.
https://www.eff.org/deeplinks/2020/01/ring-doorbell-app-pack... (https://news.ycombinator.com/item?id=22165568)
It's also worth noting that every corporate IT department I've ever seen installs antivirus software on employee machines, so it must be good for something? I'm curious what the actual statistics are for caught viruses.
The newer products are different and more effective, and come with an appropriate price tag. (The Microsoft solution costs as much as O365!)
Corporate IT at my previous employer even allowed and aided us in uninstalling the resource-hogging McAfee installation that comes default with a company machine. That stuff was crippling our machines.
Broke everyone in the company for weeks (?), because the only thing it allowed was ports 80 and 443.
No one could figure out what the problem was, because the OS-standard firewall configuration clearly showed that all the required ports were open, and therefore it couldn't possibly be a firewall problem.
Well, at least it broke all those people who had the corporate MDM software installed on their machines. Those who had a different MDM installed and so could not install the corporate MDM, well those people were able to get regular work done.
It actively attempts to inject its own version of libwebp into nearly every single build and breaks them because it's not signed!
It's maddening, and crippling! We've recently moved umbrella companies, so that software will hopefully be going the way of the buffalo, but I can't even run Vagrant on my machine because of it.
AV minimally checks a box.
>Deploy anti-virus software on all systems commonly affected by malicious software (particularly personal computers and servers).
So most enterprise companies have to have AV on their workstation and servers (yes Mac and Linux too) in order to keep processing credit card payments.
[1] https://www.pcisecuritystandards.org/documents/PCIDSS_QRGv3_...
Definitely not the case for Paypal.
As soon as the charges cross certain rolling dollar amount, one needs to complete a security assessment that requires AV in addition to a pile of other idiotic things - such as a specific set of signatures returned by the web servers in a scan by TrustWave. Unrecognized signature? Failed!
Source: first hand experience.
Paypal told us it applied to us and we either had to do it or they would block our seven digit monthly charges.
The reality of PCI/DSS is a bit more ... complex.
What it really comes down to is whatever your auditor says you have to do in order to meet the requirements. And history has already taught us that if your auditor is one of the Big Accounting firms, then they can be ... flexible ... if you're a big enough customer.
So, there's the letter of the law, and then there's what you actually have to implement in your code. And the two may have relatively little to do with each other.
Just make sure that you document everything you do within an inch of your life and the life of the code in question, so that when there is a breach (and there WILL be a breach), you're not the one that is being left out in the cold.
Before that, you could drive down the big vendors, alot. I think I paid like $2/pc/year for McAfee back in the day.
If you use SCEP (Windows Defender Managed by SCCM) or other tools, you're probably ok. But don't quote me!
Yes, it absolutely is good for something. Antivirus software is excellent for making companies like McAfee highly profitable, and it's also really good for slowing down your computer.
I had some respect for them some time ago, but these days their product is shit and worse than having nothing. Plus with Windows defender, who still actually pays for it?
For prevention, limited roles/access and patching does all the heavy lifting.
Detection happens on the server and network side. Otherwise we are expecting a compromised device to know/report itself.
Remediation is a wipe and reload from known sources. When properly automated it is faster than running a full AV scan, and much more reliable.
Ding! Ding! Ding!
Does your company need to accept credit cards? Guess what? You must have AV as there are only two choices in a self assessment form:
[ ] Anti-virus and anti-malware software is deployed on all systems used by the company staff.
[ ] Anti-virus and anti-malware software is not deployed on all systems used by the company staff.
Selecting the 2nd makes one fail self-assessment which in turn denies company's ability to accept credit cards.
Security is a charade.
It was decided the risk of using software not on the list was not worth it.[0]
[0] It was the 2nd annual assessment/audit I was involved in -- during the first one the sticking point was that our user-facing website was exposed to users via a CDN that was detected by the vulnerability scanner as some PHP application, which caused us to fail that test. Needless to say we did not want to deal with such mess again.
I guess as long as everyone's getting paid...
Given the dirty things that AV does to "work" correctly, you can characterize modern AV as malware that tries to keep other malware out.
I'd say that the problem with AV is that it has never worked at all; it's always been a "deck chairs on the Titanic" performative spot clean situation – at best, a smart team that reimages a machine with a confirmed "infection" can say they're using AV as a weak sort of host intrusion detection system.
AV or no AV, for as long as I can remember (back into the 1990s), if your desktop is "infectable", you're screwed. You'd think that the Summer of Worms would have confirmed that for everyone, but AV is an extremely powerful marketing product category, because of its built-in per-seat multiplier.
Where does the "consent" mentioned there occur? They claim to be GPDR compliant; it has to be explicit and separate from other agreements.
They're in Prague, would be nice to see the teeth of the GDPR used to put the fear of god into parties in this space. Maximum penalty times the number of clients they had should do the job nicely.
I don't think shit like this will stop unless executives and the engineers who humor them start getting their lives justifiably destroyed.
Why hasn't this requirement been updated to somthing more sensible?
IT installed freaking Norton on all of my new Macs. Now I feel less safe, and I get the software nagging me all the time.
What this means is that as long as you isolate your cardholder environment, you don't need to deploy AV across your whole company - only on those in scope.
I'm not a huge fan of AV, but I do advocate for a layered approach to security, and have to concede that AV may have some value as a "last chance" layer if malware somehow manages to get past your other defences.
That was when I decided to stop using Oracle Java on all my personal systems and minimize my use of Oracle products on a professional basis. Learning they were a malware distributor was the drop that tipped the bucket.
> Java was when I decided to remove Java from my toolset.
Would just like to say, OpenJDK is quite a solid step-in replacement for Oracle's Java: https://openjdk.java.net/
I've used it in production, I've built apps that I then _had to_ use Oracle's Java (without problem), using older and newer versions have been very stable - would very much recommend. I had one issue 8 years ago between versions, but nothing since.
For McAfee it's called the McAfee Removal Tool, and for any Symantec product, there is CleanWipe as well as the Norton Removal Tool.
I am not sure of the legality of posting these tools publicly, but they are probably easy to find via search engine or torrent. May not help you if you're working with corporate machines, but I use them all the time for any machine I inherit or when helping out friends and family.
I have never really felt the need of antivirus plugins. Firefox's built in features (https://support.mozilla.org/en-US/kb/how-does-phishing-and-m...) has always been good enough in my experience.
[1]: https://safebrowsing.google.com/safebrowsing/report_phish/?t...
I know this because I helped someone install McAfee antivirus a few days ago. Both Chrome and Firefox showed a small, non-modal popover on the next launch saying that an extension had tried to install itself. The popover contained two buttons, one for enabling the extension and one for keeping it disabled (Chrome) or uninstalling it (Firefox). If you never clicked inside the popover (as many alert-blind users might do), the extension would stay disabled.
That was the last straw - Windows Defender only at this point of time.
The only antivirus I run at the moment is Windows Defender. For me the main reason is that Microsoft actually benefits from a virus free system because it improves Windows as a platform. Antivirus software vendors benefit from viruses spreading around because it improves sales of their products.
Also Windows Defender is fairly non-intrusive, it doesn't advertise a sketchy VPN, a sketchy adblock, a sketchy torrent or any other tool that usually anti-virus vendors try to bundle together.
Most viruses aren't stealthy, although a few are, and you're right, those you'll have a hard time with if they're well hidden and undetected.
IMO - Something like Glasswire + Windows Defender is pretty robust. Nearly any virus will need network connectivity after all.
Do you have data?
A lot of viruses sell "installs" - where other less moral software devs will pay per installation of their software. Or they spam ads across your entire computer etc. Or they encrypt your files and demand a ransom. None of these things are quiet or stealthy - anybody with decent IT experience will notice them pretty fast.
It's kinda like regular crime. Sure every once in a while there's a thief that quietly lockpicks his way into somebodies home after spying on them and knowing they've left on vacation, leaving little evidence they took anything at all. Most of the time somebody just does a smash-and-grab, quick and dirty.
I keep running into the same phenomenon everywhere; everyone thinks they know whether they've been infected or not. I suppose everyone is a malware expert, so there's no need to share the data with anyone. I'm quite out of the loop here.
I mean I get what you're saying. My point is that most viruses aren't trying to be hidden, so they're rather obvious. Of course there's a chance they try to be sneaky, and you're right you have no way of knowing if those are present and well hidden.
But anti-virus only does so much, if you're past Windows Defender you're past a bunch of other tools too. A lot of anti-malware software is very generic, and relies on some rather dumb techniques.
Microsoft and antivirus vendors have very different goals. Microsoft wants to quietly protect your computer without making a big deal out of viruses, while antivirus vendors always want to let you know that they're hard at work protecting you and that the world is a dangerous place so keep giving them money(or in the case of free versions, keep it installed so they can keep vacuuming that data).
I wish that my various "premium" subscriptions to services like Spotify or various other apps meant that my privacy will be respected but I have absolutely no illusions about it. That's why I'll never ever consent to turning off u-block, I want the freemium/ad-driven model to die, it's the original evil that makes all these practices worthwhile.
Because it's the right thing to do? Why is it so hard for people in technology to simply do what's right?
I don't buy the hackneyed HN arguments about "A company is required to maximize profits for the shareholder!" or high school thought exercises like, "Who gets to decide what is right?" It's simply not that hard.
I wonder if software engineers had to pass ethics classes like other types of engineers if the world would be a different place today.
Example:
What is an acceptable use case:
A) Utilizing photo manipulation to place an individual somewhere they haven't been before.
B) The same except for them to enter in a contest.
C) The same, for some one who just wants the picture to flesh out a personal scrapbook with a picture of them and their SO having done something they wanted to do, but the SOwasno longer alive for somehow.
They don't do a great job at preparing you to understand how industry gets you to actually do unethical things, or how to react when they do.
I.e. It's rarely, in my experience, "Hey, do blatantly unethical thing." Though that happens. I've had some snuck by my filters in the form of
>Hey welcome aboard! <Several months of innocuous work later>. Okay guys, time for <skeevy thing>. Business really needs this, so it's pretty high visibility.
Generally it escapes your notice because for once you're just happy to have clear requirements, and to not be getting jerked around, so you do it. Minimal complaint is encouraged, or will at least be pretended to be entertained, relying on the cushy salary and in-house benefits to carry you through to job completion.
But the ball keeps rolling regardless. You can decide to not work on certain stuff, but that generally gets shluffed off to another team that doesn't share your ethical proclivities.
The sad thing is, you almost need a labor or professional organization like structure to be capable of keeping major divergence from the ethical straight and narrow in check, because otherwise you can pay lip service to higher ethical and moral standards, but when it comes paycheck time, most are going to go with that phat paycheck.
I'm working on considering my next link in the career chain, and ethical implications are strongly influencing my choice. I'm sick and tired of being someone else's money vacuum mechanic. I'd like to work on software that actually helps people.
And I'll stop anyone who suggests "but those systems are capital pumps, and help people because the free market." No they don't not in any but the most indirect of ways. If people overall weren't having all their siphoned off them, I'dwager there would be a much higher degree of actualization or entrepreneurial development in the hands of less capital starved people.
I know a positive feedback loop when I see one, and you can damn well bet that's why every tech company is scrambling to become a fintech in one way or another.
I had to take one as part of my ABET program. I highly doubt it made a difference. If anything, it demonstrated how much ethical behavior varies between people. I distinctly remember conversations about how awesome computer-aided sniper rifles would be (before these became a literal thing). That seems completely unethical to me, but I went to a college full of people getting back from tours in Afghanistan, so they had a very different perspective on the topic.
True, as long as keeping outdated software/practices is facilitated. The attack surface is relatively small if someone installs only apps from an App Store - no matter which one that is - and from well-known vendors.
That said, Microsoft has created a nice breeding ground for viruses by keeping all the software backwards compatible but accepting that users might need to get new hardware for every major update. At least the major updates have become quite cheap...
I remember when it came out and it would scan away and do it's thing and it was pretty much noticeable. I was "yeah this is it" uninstalled whatever I was using at the time and never looked back.
That was a big plus in a market where as you say everything feels sketchy.
From the article:
> Some past, present, and potential clients include Google, Yelp, Microsoft, McKinsey, Pepsi, Sephora, Home Depot, Condé Nast, Intuit, and many others.
Microsoft doesn't need its AV products to do shady data collection because it outsources this to third-party shady AV products, therefore keeping its own reputation clean as your post demonstrates.
> Microsoft declined to comment on the specifics of why it purchased products from Jumpshot, but said that it doesn't have a current relationship with the company.
Which seems to indicate that Microsoft is in the list of past, not potential clients.
And a follow-up, "Avoid Non-Microsoft Antivirus Software", https://news.ycombinator.com/item?id=13489100
I believe there have been academic studies on the non-effectiveness of antivirus software, but I can't find them. (If others can, I'd like to read them.) I find the argument that antivirus software increases attack surface compelling because it's third-party software that tries to get into everything. This is not the '90s anymore; all of the big players care about security. I think that the engineers at Microsoft, Google, Apple and Firefox are more qualified to secure their own software than outside vendors are.
1. Security on desktops has been improved quite a bit. You can no longer simply email someone a .exe file that's the equivalent of `sudo rm -rf /` and have it work, multiple levels of safeguards (from the browser, to the email virus scan to windows defender catch it). OS's also simply won't run unsigned binaries anymore unless you force them to which is (maybe?) a good thing.
2. Piracy has been on a downtick, and people seem to be more open to paying for software since App stores made it somewhat more acceptable. Less likelihood that people download sketchy binaries off the internet and run them on their PCs.
3. More hours spent on mobile OSes which are inherently more secure. casual PC usage at home is declining.
Wine literally stands for “Wine is Not an Emulator”.
It won't have direct local OS access, but files and networking can be shared through most emulation systems, generally as SMB/CFS shares.
* except for that which is or comes with Windows. Unfortunately this has grown substantially - Windows 7 seems like something of a high-water mark for performance/polish/lean...
Another issue that while microsoft's incentives may be better aligned it still fundamentally is an antivirus and thus an increase in attacksurface. There have been exploits against it[0] and it turned out that it did things with SYSTEM privileges and no sandboxing.
[0] https://bugs.chromium.org/p/project-zero/issues/list?can=1&q...
It’s like a locksmith company monetizing by sneaking people into your home when you’re asleep
Edit: I only know this because I recently heard about this guy on the British TV show "QI".
Also don't add snake oil parts to their products like registry cleaners and install extensions. The most obtrusive thing they do is probably MITM TLS connections which I don't agree with but at least kinda understand.
As for the data monetization, you can compare privacy policy of those two companies https://help.eset.com/eav/12/en-US/privacy_policy.html vs https://www.avast.com/products-policy . They speak for themselves.
I wouldn't mind if better marketing for Windows Defender made a bunch of shady antivirus companies go bankrupt, but Microsoft probably doesn't want to get into another round of antitrust lawsuits.
Apparently by selling your information.
My go to is to say, the security lead for Google Chrome once tweeted, "the biggest impediment to implementing a secure browser is AV software."
https://www.blog.google/products/chrome/cleaner-safer-web-ch...
I don't think he took issue with the idea of a well-maintained database of signatures used to identify malicious code, just most vendors implementations that check against such.
i'm having a hard time reading past the word "potential". that suggests exaggeration to me.
Probably just incompetence... Probably!
Right. Just like Zoom.
NB this article also notes the selling of data - from the article it cites:
> Jumpshot is the data arm of Avast[...] This suite of products, in order to function, must collect and analyze every URL visited by every browser of every machine on which its installed. [...] Because Avast has to see and process all these URLs anyway (in order to serve their function of providing web security), they anonymize, aggregate, and remove any personally-identifiable information from the browser URL visits and then provide them to Jumpshot, who then makes estimates about broad web usage behavior. In my opinion, this is both an ethical way to gather crucial data about what’s happening on the web[...]
Hopefully Discord's day is coming soon.
It’s a free product and it’s written in T&S, why is Vice so sensational?
EDIT: Calm it, I was proven wrong about the EULA
https://www.avast.com/eula does not mention Jumpshot and grepping around does not indicate any sensible anonymization and aggregation efforts, just the default legalese whereas the demo video on https://www.jumpshot.com/solutions/industry/retail leads me to believe that while they might not tie histories to a single user, they show statistics like "XX% of users shopping at A, went on to buy at B" which indicates at least some level of unaggregated data / tracking.
If the Vice article is to be believed, that's certainly enough to at least raise an eyebrow. The opt-in the article talks about is likely to be an underspecified mess that's intended to decieve the user, this functionality has simply no place in an AV package. Let's not act like it's hard to get users to press a shiny green button these days. That might be found GDPR compliant in court, it's still not morally right.
I'll give them the benefit of the doubt but if the Vice report is accurate, the business practice needs changing, not their terms of service.
> "It's very granular, and it's great data for these companies, because it's down to the device level with a timestamp," the source said, referring to the specificity and sensitivity of the data being sold
> Jumpshot gave Omnicom access to all click feeds[...] The product includes [...] "the entire URL string"
> A set of Jumpshot data obtained by Motherboard and PCMag shows how each visited URL comes with a precise timestamp down to the millisecond, which could allow a company with its own bank of customer data to see one user visiting their own site, and then follow them across other sites in the Jumpshot data.
How can you _possibly_ anonymise that at scale? Maybe someone searches an email address, or searches a unique phrase, such as a nickname, that identifies them. If someone makes multiple searches for directions from/to a particular place, it's probably their home or work. If you are logged in to a company's site, they likely know exactly who you are, and can correlate their logs with the Jumpshot logs (URL+millisecond timestamp could very well be unique) to follow you across other sites. The article notes that some products include "inferred gender" and "inferred age" - what _else_ can you infer from the provided data that may be enough to ID you?
Even if they _aren't_ directly selling it, it's a uncomfortable amount of information for a company to have (at best).