Regulator action · 22 February 2024
In re Avast Limited (sale of browsing data)
FTC Docket No. C-4805 (2024) · United States Federal Trade Commission
What it means for your code
Telemetry you sell is not anonymous because you stripped the name. If a record can be tied back to a person by anyone downstream, treat it as personal data.
What happened
A security product that advertised blocking tracking collected users' browsing histories through its browser extension and sold them through a subsidiary, described as aggregated and anonymous.
What was decided
Selling granular browsing records without clear consent is unfair, and calling re-identifiable records anonymous is deceptive.
⚖ USD 16.5 million and a ban on selling browsing data for advertising
The legal test applied
- Selling granular browsing records without clear, informed consent is unfair
- Describing re-identifiable records as anonymous is deceptive
- A product marketed as blocking tracking is held to that representation
What would have changed the outcome
- Genuinely aggregated statistics that cannot be resolved to an individual are outside the theory
Source: United States Federal Trade Commission, www.ftc.gov. Summary and analysis by Lawpatch. Risk analysis, not legal advice; the law may have moved on since this decision.