{"id":90956,"date":"2020-01-31T07:29:31","date_gmt":"2020-01-31T15:29:31","guid":{"rendered":"https:\/\/www.intego.com\/mac-security-blog\/?p=90956"},"modified":"2020-01-31T07:29:31","modified_gmt":"2020-01-31T15:29:31","slug":"when-free-means-collects-your-browser-history","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/when-free-means-collects-your-browser-history\/","title":{"rendered":"When free means “collects your browser history”"},"content":{"rendered":"

\"\"<\/p>\n

\"\"Back in September 2018, a number of Mac App Store apps from two different developers<\/a> were found to have been collecting Web browser history without users’ consent and sending it off to developer-controlled servers. Surprisingly, one of the developers of these shady apps was a company that had been in the antivirus industry for 30 years.<\/p>\n

One might imagine that this was a one-time incident, and that other antivirus companies would learn from the errors of their industry peer.<\/p>\n

Sadly, a similar situation came to light this week involving yet another 30-year-old antivirus company.<\/p>\n

In a joint investigation between Motherboard<\/a> and PCMag<\/a>, it was revealed that antivirus software from Avast and AVG (an Avast subsidiary) collects “a stripped and de-identified data set derived from your browsing history”\u2014if<\/em> the user consents at the time of installation of their software.<\/p>\n

\"Avast

Avast Free Antivirus screenshot: “Mind sharing some data with us?” Image: PCMag<\/a><\/p><\/div>\n

Avast did offer users the choice whether or not to opt into data collection, in this case. Nevertheless, an argument could be made that the bright, default “I AGREE” button is the most obvious way to begin using the app, and many users will just keep clicking through and not read the fine print on the screen. Even if users read it, they might assume that since Avast is a computer security company, they must be handling data in a way that respects user privacy\u2014and it turns out that the fine print on this screen doesn’t tell the full story anyway.<\/p>\n

“De-identifying” or “anonymizing” such data is not an easy task\u2014especially when the clients who want to buy that browser history want as many details as possible. Your browsing history tells a lot more about you than you might realize. As we mentioned in our article about the history-snarfing App Store apps:<\/p>\n

Web browsing history can contain very private, personal, or sensitive information. Often it\u00a0can contain personally identifiable information, or strong clues as to the\u00a0exact identity of the user. It may reveal things such as\u00a0home and work addresses (e.g. via Google Maps searches), medical conditions (e.g. via search engine or medical site queries), sexual preferences (e.g.\u00a0via the types of dating sites visited), and a multitude of other things that\u00a0should not be\u00a0freely available to an app developer without obtaining the user\u2019s explicit consent.<\/p><\/blockquote>\n

There’s a lot more to this story, and for what it’s worth, Avast’s CEO has issued a public apology, and stated that the company’s board of directors has decided to immediately end the collection of browser history data and to “wind down [Avast’s data-sales subsidiary] Jumpshot’s operations.” If you’re interested in additional details, you can refer to PCMag’s coverage<\/a> and Motherboard’s coverage<\/a> of the story, and Motherboard’s follow-up<\/a>.<\/p>\n

When companies offer free software or services, think carefully<\/h3>\n

Avast and AVG both offer “free” (as in money) antivirus software. Whenever software or services are offered for free, it’s a good idea to consider the possible motives of the offerer\u2014especially in the case of commercial entities who give away (what appears to be) their main product. How can a commercial entity pay its employees without a revenue stream? If you cannot easily determine how a company makes money, and they offer something for free, you must consider that you (or rather, your personal data) may in fact be the product.<\/p>\n

What about Intego?<\/h3>\n

An Intego customer (who had presumably read about the Avast story) wrote in and asked us whether we sell any personal information about our users.<\/p>\n

We’re proud to say that our software does not collect users’ browser history, and we have no intention of ever doing so.<\/p>\n

Furthermore, Intego does not sell or rent customers’ personal information to anyone.<\/p>\n

Protecting our users is a core principle for us\u2014as we believe it should be for all companies in the business of endpoint security and privacy.<\/p>\n

How can I learn more?<\/h3>\n

\"\"<\/a>This week on the Intego Mac Podcast<\/strong>, we discussed the Avast story along with other recent examples of “free” things that turn out to have a hidden cost. Be sure to subscribe<\/a> to make sure you never miss the latest episode!<\/p>\n