Class-action lawsuit against antivirus firm for selling data of millions of Dutch people

The Czech security firm, Avast, is being sued in a mass claim lawsuit. The plaintiffs include the CUIC Foundation (Consumers United In Court), cooperating with the civil rights organization Privacy First, AD reported on Friday. The company, known for its antivirus software, is accused of selling sensitive data of millions of Dutch users for several years.

The class action lawsuit emerges from a case that first garnered attention in 2019. It was revealed that Avast had been collecting sensitive user data for years, including Google searches, locations, online purchases, viewed YouTube videos, and browsing histories.

"It is the world turned upside down. You install an antivirus program to protect your computer, and in return, you get spied on. We consider this a huge scandal,” a spokesman for CUIC told the news website.

The collected data was then resold through Avast's subsidiary, Jumpshot. This data was bought by large corporations, including Google, Microsoft, Yelp, and Pepsi. These companies paid millions for access to datasets that would enable them to glean detailed insights into users' online behavior.

Over the past few years, Avast's software, which includes Avast Secure Browser, AVG Secure Browser, and AVG Online Security, has been used by more than 400 million people worldwide. This includes an estimated five million users from the Netherlands.

Most of Avast's software is free, and users often receive ads in return. The terms and conditions disclosed that customer browsing history would be collected, but that data would be anonymized to preserve privacy. However, experts dispute this claim, pointing out that the data is linked to a unique device ID, making it possible to trace browsing behavior back to individual users.

CUIC Foundation is particularly shocked that Avast, an antivirus provider designed to offer users security, was involved in reselling user data for monetary gain. "That is simply theft. It's like having a good friend over to stay, and then they rob you of all your valuable possessions while you're asleep. We shouldn't consider this normal. It's time to draw the line," the CUIC spokesperson said.

While Avast ceased the sale of user data in January 2020 and issued an apology, the CUIC Foundation insisted that duped consumers deserve compensation for their stolen data. "You should not be able to get away with this kind of practice," said Wilmar Hendriks, president of CUIC Foundation. "Saying sorry is one thing, but compensating customers for their stolen data would be a good signal," he added.

Dutch people who used Avast's antivirus or browser extension on any device between 2015-2020 are encouraged to register for compensation. Registration is free. "The more consumers join, the greater the chance that Avast will have to provide compensation to users," Hendriks said.