Cybersecurity company Avast has agreed to pay $16.5 million to settle allegations by the Federal Trade Commission (FTC) that it collected and sold users’ browsing data without consent. The FTC accused Avast of deceiving consumers about its privacy practices through its popular antivirus software and browser extensions.

The saga began in January 2020 when investigations by Motherboard and PCMag revealed that Avast was harvesting extensive data on users’ online activities through its products. This included sensitive information on medical conditions, locations, sexual orientations and more.

Avast then allegedly sold this data through its subsidiary Jumpshot to over a hundred companies, enabling targeted advertising. Internal documents showed the data was specific enough to identify individuals.

The company claimed at the time it had safeguards to anonymize users. However, the FTC found Avast failed to properly mask personal details. In fact, the data contained unique identifiers allowing companies to track individuals across websites via Avast’s software.

The privacy violations occurred from 2014 up until the Jumpshot unit was shut down in 2020 following the media reports. Millions of users were affected worldwide.

Along with the monetary penalty, the proposed FTC order will prohibit Avast from collecting and selling user browsing histories for advertising and marketing purposes. It must delete or anonymize all previously collected data as well.

Additionally, Avast will be required to clearly disclose its data collection practices and obtain opt-in consent in the future. The company will also be barred from misrepresenting the privacy and security of its software.

In a statement, Avast said it disagrees with the FTC’s allegations but has settled to resolve the matter. The company stated: “We are committed to our mission of protecting and empowering people’s digital lives.”

The settlement is currently open for public comment before final approval. However, it makes clear that cybersecurity providers must be transparent with users about how their data is utilized. For Avast, a lack of disclosure to consumers has proved costly both to its reputation and bottom line.