Most folks download security applications to keep themselves safe from hackers and anyone looking to steal data. But in a new revelation on Monday, one security application could be collecting all kinds of information on you and selling it to some of the world's biggest companies.

In a wide-ranging report on Monday, Vice's Motherboard and PCMag revealed that Avast, a popular security platform used by millions of people around the globe, has been using its security software to collect highly sensitive information about its users and selling it to major companies as far-ranging as Google, Yelp, McKinsey, and countless others, through a subsidiary called Jumpshot.

In a shocking revelation, the news outlets found that Avast promised to sell companies "Every search. Every click. Every buy. On every site." In other words, Avast's security software has been reportedly able to see and track nearly all of its users' activities, collect it, and then sell it for untold sums to major companies.

The sheer amount of information Jumpshot can sell is shocking in its breadth. It ranges from the ability to see every website users go to, to the times at which they click on pages on a website. Even more exceedingly personal searches and clicks, like those on pornographic websites, are also collected, according to the report.

The news outlets were quick to note that Avast has anonymized the data, so a person's name, e-mail address, and IP address aren't shared with buyers. However, each person has a unique identifier that could technically point to what they're doing on their machines.

"We ensure that Jumpshot does not acquire personal identification information, including name, email address or contact details," an Avast spokesperson told Inc. in a statement. "Users have always had the ability to opt out of sharing data with Jumpshot. As of July 2019, we had already begun implementing an explicit opt-in choice for all new downloads of our AV, and we are now also prompting our existing free users to make an opt-in or opt-out choice, a process which will be completed in February 2020."

The spokesperson added that the company has privacy controls in place for users to determine how they want their information tracked. 

There's no telling what this ultimately means for the company's Jumpshot. However, some companies that purchased the data from Jumpshot appear to be backing away from the possible privacy implications.

Home Depot, for instance, told Motherboard and PCMag in a statement that it only agreed to buy the data because it was anonymized. Yelp told Motherboard and PCMag that it bought Jumpshot's data to analyze the impact of Google's "anticompetitive behavior on the local search marketplace."

But it's still a major concern. 

The fact is, security software is downloaded to mobile phones, tablets, and computers because people believe that the software is helping them to stay secure. It's hard to believe many of those people would download the software if they knew that the program was tracking their every move and selling it to major companies around the globe for their own gain.

Luckily, there might be a quick fix to the problem. Avast's software can reportedly only track users when the program is running on a device. After being uninstalled, user data is kept private and away from prying eyes.

Here's hoping further investigations don't reveal similar tactics by other security companies that should, at least in theory, be among the more trustworthy developers out there.

Published on: Jan 28, 2020
The opinions expressed here by Inc.com columnists are their own, not those of Inc.com.