18/02/20 UPDATE: We have just been informed that Hitwise will cease all operations due to a heavy reliance on Jumpshot data. Source: PowerRetail.com
Who can we trust to protect our online privacy in a world where the government actively spies on us and our anti-virus software sells our data to third-parties via a subsidiary?
In the midst of new revelations regarding invasive data collection, Avast announced the discontinuation of Jumpshot, the company’s marketing technology division.
Avast’s Data-Selling Activities in Recent News
On December 3rd, Avast found itself in hot water when Mozilla removed its extensions from the Firefox Add-ons library due to reports suggesting the cybersecurity company was collecting users’ browsing histories and other metadata.
The whistleblower, AdBlock Plus creator Wladimir Palant, voiced concerns over the fact Google Chrome was incredibly slow to act on the matter.
Despite Google claiming to crack down on extensions that behave in this manner, it took a little over 2 weeks for the company to react to reports by removing some (though not all) of the offending extensions on December 20th.
Even Opera – a far less popular browser and not any better than Chrome when it comes to user privacy – acted within 16 hours.
The Avast and AVG extensions were reinstated in Firefox on December 23rd after the company made necessary changes to bring it more in line with Mozilla’s requirements and promised to continue doing so.
But Avast didn’t quite get away with the practice of snooping on users.
A more in-depth follow-up investigation, spearheaded by Vice’s Motherboard (in collaboration with PC Mag), determined the company’s subsidiary, Jumpshot, was not only continuing to receive recorded user data beyond its intended capacity, but was selling it to third-parties such as Google and Microsoft.
Avast since announced they are dissolving Jumpshot.
The Jumpshot website is already inactive, though the company will “continue paying its vendors and suppliers in full as necessary and in the ordinary course for products and services provided to Jumpstart during its wind-down process.”
What Is Jumpshot?
As mentioned at the beginning of this report, Jumpshot is (or was) Avast’s marketing technology division.
The subsidiary was established by the anti-virus provider in 2015 to “create an innovative way to provide marketers with trend analytics and statistics on customer purchasing habits that was de-identified, rather than specific user targeting that has been historically pervasive on the web.”
One of the more publicly-known uses of Jumpshot was by Search Engine Optimization (SEO) companies and software providers to help aggregate and provide user metrics.
Jumpshot was by no means the only way for customer behavior data to be gathered – Google Analytics remains the most popular.
Who Does The Shutdown Affect?
The shutdown means Jumpshot’s demise is affecting more than just the hundreds of employees being laid off.
Hitwise (one of the SEO/customer behavior data companies mentioned) is being affected rather drastically.
In an email shared publicly and published by Search Engine Land, customers were informed “on-going Hitwise daily, weekly, and monthly metric updates are being paused – with further notice to come of when service will resume.”
While the company failed to confirm, it seems Jumpshot is the “primary clickstream data provider” and Hitwise’s announcement says it’s “no longer in a position to provide Hitwise with data as of 28th January 2020.”
Some of Hitwise’s biggest competitors include SEMrush, Moz, and SpyFu. These companies claim their service will not be affected.
SEMrush Head of Global Marketing, Olga Andrienko, posted Jumpshot data was previously used (insinuating discontinuation prior to the exposure), but was never the service’s primary provider.
Similarly, SpyFu’s founding partner, Dave Fiske, said Jumpshot was never a SpyFu data provider to begin with.
A Moz spokesperson, on the other hand, admits to the service’s use of anonymized data provided by Jumpshot. However, the Avast subsidiary was merely one of “multiple data sources,” and “The Moz metrics most folks rely on will continue to be reliable as we go forward.”
Avast’s Response
Avast didn’t merely announce it was shutting Jumpshot down.
On January 28th, in an official blog post – titled “Avast’s Commitment To Responsible Data Use” – the company claimed it’s innocent of any wrongdoing:
“While we acted fully within legal bounds, always remaining vigilant to protect our users’ privacy, we have listened to recent feedback and have already taken steps to align with the expectations of our users and continue to consider how a trends analytics service aligns with our values as a cybersecurity and privacy company.”
Legal Or Not – It’s A Gross Violation of Your Right to Online Privacy
Earlier in the same post, the company explained “at no time have we sold any personally identifiable information to a third party.”
While this does appear to be true (in the sense that data sold to third parties was strictly anonymized), it’s not quite in line with how online privacy works.
As explained in our post “The Ultimate Online Privacy Guide” user data collected online can be divided into two categories: Personally Identifiable Information and Non-Personally Identifiable Information.
Collecting, analyzing, and even sharing non-personally identifiable information is indeed within the legal bounds. Doing so has many practical uses in optimizing a website’s performance (which is why it’s collected by services like Moz and SEMrush).
However, the major issue lies in how non-personally identifiable information is often used by companies like Google.
As the world’s most popular search engine – and especially when combined with the Chrome browser – Google has access to a lot of personally identifiable information as well.
And when combined with this kind of data, non-personally identifiable information quickly becomes a massive supplement in creating a virtual profile of users.
It goes beyond using this data for advertising, though.
Google and many of the other Jumpshot clients purchasing the collected data are known to aid in government surveillance.
See How Government Surveillance Kills Your Online Privacy and our Beginner’s Guide To The 5/9/14 Eyes Alliance for a better understanding of just how negatively this impacts your online privacy.
Did Avast Show Its True Colors?
Just as worrisome is the fact Avast and Jumpshot went out of their way to keep the third party deals a secret.
As per the report published by Vice’s Motherboard, evidence shows “the sale of this data is both highly sensitive and is in many cases supposed to remain confidential between the company selling the data and the clients purchasing it.” (Emphasis added.)
This opens up the question as to whether Avast can truly be trusted as a cybersecurity company claiming to be pro-privacy.
It’s yet another dark reminder of Why You Should Always Read The Privacy Policy.
