US Senator Mark Warner (D-Virginia) is questioning why the FTC hasn't investigated the data collection practices of antivirus companies following a PCMag-Motherboard investigation into the privacy risks of Avast selling the customer browser histories to third-party companies.
"It's increasingly clear that the FTC hasn't kept up with how these markets for data operate, and appears to be unwilling to use its authorities to do so," Warner said in a statement.
On Monday, PCMag and Motherboard published a joint investigation examining Avast's free antivirus products and how they can expose your website clicks to corporations and market research companies. Although the antivirus company claims it "de-identifies" the collected browser histories before selling the information off, the same data can still be analyzed to link a person's web activities to their real identity.
In response to the investigation, Warner said: "Time and again we've seen that consumers are totally unwitting to the ways their data is being collected, commercialized and sold." He not only pointed to antivirus companies, but also web browsers and VPN services, which have attracted scrutiny as well over potential spying risks.
"Yet in each of these cases we've repeatedly seen trusted intermediaries undermine the privacy and security of consumers," he added. "No consumer would realistically have an inkling that their antivirus software could be selling their browsing data and—even more sensitive information such as mouse movement— to an array of third parties."
In the case of Avast, the free antivirus software is capable of scanning every site your browser is visiting as a way to warn you of any malicious or fraudulent activity. However, the same feature can also harvest your browser history, along with any sensitive search terms you've made through Google or Bing, according to PCMag's investigation.
The good news is that users can easily opt out of the data collection by going into the antivirus software's privacy settings or turning it off on install. However, Avast's marketing and privacy promises around the data harvesting may convince people otherwise; the company has been recently asking all users to opt into the data-sharing when the Avast subsidiary in charge of monetizing the browser histories, Jumpshot, has been selling access to the data for million of dollars.
In his statement, Warner said: "Congress can't afford to ignore these issues any longer." The senator previously introduced other legislation to crack down on deceptive website practices that can fool you into handing over your information. But the US still has no federal digital privacy law in place.
The FTC declined to comment, saying "investigations are nonpublic." But the regulator told Motherboard: "However, we are very familiar with how these markets for data operate, and will not hesitate to take appropriate action as necessary where we find conduct that violates the laws we enforce."