unnamedAntivirus software producer, AVG, has made some big and surprisingly open changes to its Privacy Policy.  The new policy boldly admits that AVG will collect user browsing and usage data to improve their products and even sell “anonymous” user data to advertisers.  While data collection is quite common among social networks and search engines, it is a bizarre admission from a cybersecurity company.

The revamped Privacy Policy, which goes into effect on October 15th, outlines the full extent of data collection that AVG employs.  The Policy reads as follows:

We collect non-personal data to make money from our free offerings so we can keep them free, including:

  • Advertising ID associated with your device
  • Browsing and search history, including meta data
  • Internet service provider or mobile network you use to connect to our products
  • Information regarding other applications you may have on your device and how they are used.”

Although personal information is gathered, AVG promises that it will be kept private and only used after it has been scrubbed and made anonymous.      AVG gives the example that, although they consider a user’s precise location private, once they combine this information into a data set with other users, it becomes aggregated data and thus is no longer personally identifiable.

Social media companies have used a similar line of reasoning to defend data collection for years but there is always a problem that gets overlooked and the extent of anonymization varies widely.  Some companies do go out of their way to protect user data but many barely obscure the data at all. While each data field may be anonymous on its own, with names and addresses removed, they are often linked through a shared database to provide better targeting for advertisements.  The result is that if a marketer wants to target everyone who has both an interest in a certain product and uses an iPad, they will be able to sort by that dataset.  Extrapolated further, this dataset can be changed to include only iPad users with a Facebook or LinkedIn page. Through sorting and filters, an advertiser is often given a wealth of additional information that probably includes a name and/or other personal information.

In AVG’s defense, they do state that all users will have the option to opt-out of the tracking program, but have not yet stated the required methodology to do so.  However, the greatest point of contention is the fact that having user tracking as an option at all turns the program into a form of spyware.  Effectively, the AVG antivirus has become the one of the very things it is supposed to protect against.

– Richard Keene
IT Computer Support of New York
Webmaster and Lead Designer