The Consumers United In Court Foundation (CUIC), an initiative of the Privacy First Foundation and Noyb, is launching a mass damages claim against Avast. The Foundation claims that the Czech antivirus developer sold the personal data of its customers for years without their consent. Because of this privacy violation, the Foundation is claiming compensation. CUIC is announcing the lawsuit via its website.
Avast collected privacy-sensitive user data
Between May 2015 and January 2020, Avast collected user data through its antivirus software and browser extensions, such as Avast Online Security and AVG Secure Browser. This included browsing history, search queries and location data, and messages users posted on social media.Avast also collected intimate and personal data. “It’s about things like sexual preferences, religious and political preferences, and your financial situation. And that all goes down to the IP address, so accurate to the person,” Willem Hendriks, chairman of CUIC, told BNR.This data was then sold through the subsidiary Jumpshot to parties such as Google, Microsoft and Yelp. However, this was done without the explicit consent of users. With this, Avast has violated “core principles of Dutch and European privacy law”, says CUIC.
Five million people used Avast.
An estimated five million people in Europe used Avast between 2015 and 2020. To sell its products, the antivirus developer responded to the need of parents to protect their children maximum’ against digital dangers on the internet.”AVAST spied on their users and sold their data. The users needed to learn that their surfing behaviour and other information were collected and then sold to third parties, who would use this data for their own commercial purposes, including behavioural targeting and profiling.This secret and unlawful data processing was only stopped in 2020 after researchers and journalists highlighted these practices.
The Foundation wants to set an example with this lawsuit
Because Avast violated the privacy of millions of people for years, CUIC is starting a lawsuit. The Foundation is claiming compensation for all consumers who have been affected. “We are going to file a claim for the damage people have suffered, the privacy violation, and then we are going to demand amounts per person that can add up to enormous amounts,” says Hendriks.
In addition to compensation, the Foundation says it wants to set an example for other companies with the lawsuit. “For many companies, privacy is a capstone rather than an essential factor in software design. There are also still companies that do not ask for explicit permission before using your data for purposes that are not simply and clearly presented to the user.”
The Foundation expects the mass damages claim against Avast to take “several years”. Anyone who used Avast between 2015 and 2020 can sign up for free. Omni Bridgeway, a Swiss law firm, funds the lawsuit. In the event of a profit, the office receives between 10 and 25 per cent of the proceeds.
Update (July 20, 2023): a spokesperson for the CUIC foundation confirms that more than 10,000 people have now registered for the lawsuit against Avast. The Foundation claims compensation between 800 and 1,100 euros per person. Due to the high number of registrations, the total damage amount is now almost 10 million euros.
Avast has apologized for selling personal data to commercial parties without users’ explicit consent. However, according to the CUIC foundation, more is needed. “You shouldn’t be able to get away with this kind of practice where money has been knowingly made from privacy violations. People have yet to learn who Avast has sold all their data and what it is now being used for. A ‘sorry’ is not enough for that. Otherwise, nothing will ever change,” said a spokesperson.