The full timeline
Avast has been around since 1988, so the record is long. The privacy issues are concentrated in a specific window.
- 1988: Founded as Alwil Software in Prague, Czech Republic.
- July 2017: Acquired Piriform, the maker of CCleaner.
- September 2017, CCleaner supply-chain attack. Attackers compromised the CCleaner build pipeline and injected malware that reached around 2.3 million users. The compromise predated the Avast acquisition by weeks; Avast inherited the incident and pushed the fix. Not Avast's fault, but their problem to clean up.
- 2014 to 2020, Jumpshot data sales. A subsidiary called Jumpshot resold "anonymized" browser-history data from Avast's free users to corporate clients including Google, Microsoft, Pepsi, McKinsey, and others. The data was detailed enough (timestamps, URLs, sessions) that researchers showed it could be re-identified.
- January 2020, Jumpshot exposé and shutdown. Joint reporting by PCMag and Vice's Motherboard surfaced the practice with internal documents. Within a week, Avast announced Jumpshot's closure.
- September 2021: Merger announced between Avast and NortonLifeLock. The combined entity became Gen Digital in 2022.
- February 2024, FTC settlement. The US Federal Trade Commission fined Avast $16.5 million for the Jumpshot practices, banned Avast from selling browsing data for advertising, required deletion of the data and any models trained on it, and required clear opt-in consent for any future browser data collection.
What this means for someone using Avast today
The Jumpshot pipeline is shut down. The FTC consent decree legally binds Gen Digital (Avast's parent) to keep it shut down. The 2024 ruling also requires Avast to "clearly and conspicuously" inform users about any data collection and obtain affirmative consent.
Three caveats worth knowing:
- The settlement does not return the trust. Avast spent six years (2014 to 2020) profiting from a practice they publicly denied when journalists asked. The pattern matters more to many users than the specific consent decree.
- Gen Digital owns a lot of your security stack now. Norton, Avast, AVG, Avira, CCleaner, LifeLock are all Gen Digital brands. If you're concerned about concentration, switching from Avast to AVG is no switch at all.
- The free version is still ad-supported. Ads inside the antivirus interface push upgrades to Avast One and partner products. Not data-mining, but it is a constant nag pattern.
The good side, in fairness
Avast's malware engine is genuinely strong:
- AV-TEST consistently rates Avast Free Antivirus and Avast One at or near 6.0/6.0 in Protection, Performance, and Usability for Windows home users.
- SE Labs gives Avast AAA ratings in most quarterly reports.
- The free version offers a real-time scanner that's competitive with paid products, which Windows Defender alone doesn't match in heuristic detection.
- Avast's Wi-Fi Inspector and unsafe-website blocker have prevented millions of phishing connections per year by their own metrics.
Should you use it?
Three answers depending on what you care about.
- If you only care about detection rates: Avast is safe and very effective. The free version is one of the best free antivirus engines available.
- If you care about privacy as much as protection: Bitdefender Free Edition is the better choice. Its parent company has no comparable scandal, and its detection scores match or beat Avast's.
- If you're using Avast right now and not sure whether to switch: the immediate risk is low. The Jumpshot pipeline is closed and legally cannot be reopened. The reason to switch is values-based, not safety-based.
Verdict
Avast is safe in the narrow sense of "does it protect you from malware?" Yes, well. Avast is not trustworthy in the broader sense of "has the company demonstrated it will treat your data the way it promises?" That record is mixed at best, and the 2024 FTC ruling is the formal acknowledgment that something was wrong. Whether that matters to you is a personal call, not a technical one.