Avast Limited et al.; Analysis of Proposed Consent Order To Aid Public Comment, 14839-14842 [2024-04257]
Download as PDF
Federal Register / Vol. 89, No. 41 / Thursday, February 29, 2024 / Notices
FEDERAL COMMUNICATIONS
COMMISSION
[OMB 3060–1253; FR ID 205344]
Information Collection Being Reviewed
by the Federal Communications
Commission Under Delegated
Authority
Federal Communications
Commission.
ACTION: Notice and request for
comments.
AGENCY:
As part of its continuing effort
to reduce paperwork burdens, and as
required by the Paperwork Reduction
Act (PRA) of 1995, the Federal
Communications Commission (FCC or
the Commission) invites the general
public and other Federal agencies to
take this opportunity to comment on the
following information collection.
Comments are requested concerning:
whether the proposed collection of
information is necessary for the proper
performance of the functions of the
Commission, including whether the
information shall have practical utility;
the accuracy of the Commission’s
burden estimate; ways to enhance the
quality, utility, and clarity of the
information collected; ways to minimize
the burden of the collection of
information on the respondents,
including the use of automated
collection techniques or other forms of
information technology; and ways to
further reduce the information
collection burden on small business
concerns with fewer than 25 employees.
The FCC may not conduct or sponsor a
collection of information unless it
displays a currently valid control
number. No person shall be subject to
any penalty for failing to comply with
a collection of information subject to the
PRA that does not display a valid Office
of Management and Budget (OMB)
control number.
DATES: Written PRA comments should
be submitted on or before April 29,
2024. If you anticipate that you will be
submitting comments, but find it
difficult to do so within the period of
time allowed by this notice, you should
advise the contact listed below as soon
as possible.
ADDRESSES: Direct all PRA comments to
Nicole Ongele, FCC, via email PRA@
fcc.gov and to nicole.ongele@fcc.gov.
FOR FURTHER INFORMATION CONTACT: For
additional information about the
information collection, contact Nicole
Ongele, (202) 418–2991.
SUPPLEMENTARY INFORMATION:
OMB Control Number: 3060–1253.
khammond on DSKJM1Z7X2PROD with NOTICES
SUMMARY:
VerDate Sep<11>2014
16:39 Feb 28, 2024
Jkt 262001
Title: Section 74.803(c) and (d),
Wireless Microphones.
Form No.: N/A.
Type of Review: Extension of a
currently approved collection.
Respondents: Individuals or
Households, Business or other for-profit;
Not-for-profit institutions.
Number of Respondents and
Responses: 65 respondents; 815
responses.
Estimated Time per Response: 0.5–2
hours.
Frequency of Response:
Recordkeeping, third party disclosure,
and on occasion reporting requirement.
Obligation to Respond: Required to
obtain or retain benefits. Statutory
authority for this information collection
is contained in sections 1, 4(i), 4(j), 7(a)
301, 302(a), 303(f), 307(e), and 332 of
the Communications Act of 1934, as
amended, 47 U.S.C. 151, 154(i), 154(j),
157(a), 301, 302(a), 303(f), 307(e), and
332.
Total Annual Burden: 818 hours.
Total Annual Cost: $55,313.
Needs and Uses: The Commission
will submit this information collection
to OMB as an extension after this 60-day
comment period to obtain the full threeyear clearance from them.
The information collection authorize
licensed low power auxiliary station
operations (referenced herein as
‘‘wireless microphone’’ operations) on
additional frequency bands.
Specifically, under section 74.803(c),
the Commission permitted licensed
wireless microphone operations on the
941.5–944 MHz, the 952.85–956.25
MHz, the 956.45–959.85 MHz, the
6875–6900 MHz, and the 7100–7125
MHz bands, provided the particular
coordination requirements were met;
under section 74.803(d), the
Commission authorized operations on
the 1435–1525 MHz band provided that
requisite conditions, including
coordination, were met. The
Commission promoted its goal by
accommodating wireless microphone
users’ needs through access to spectrum
resources following the incentive
auction and reconfiguration of the TV
bands.
Federal Communications Commission.
Marlene Dortch,
Secretary, Office of the Secretary.
[FR Doc. 2024–04213 Filed 2–28–24; 8:45 am]
BILLING CODE 6712–01–P
PO 00000
Frm 00040
Fmt 4703
Sfmt 4703
14839
FEDERAL TRADE COMMISSION
[File No. 202 3033]
Avast Limited et al.; Analysis of
Proposed Consent Order To Aid Public
Comment
Federal Trade Commission.
Proposed consent agreement;
request for comment.
AGENCY:
ACTION:
The consent agreement in this
matter settles alleged violations of
federal law prohibiting unfair or
deceptive acts or practices. The attached
Analysis of Proposed Consent Order to
Aid Public Comment describes both the
allegations in the complaint and the
terms of the consent order—embodied
in the consent agreement—that would
settle these allegations.
DATES: Comments must be received on
or before April 1, 2024.
ADDRESSES: Interested parties may file
comments online or on paper by
following the instructions in the
Request for Comment part of the
SUPPLEMENTARY INFORMATION section
below. Please write ‘‘Avast Limited, et
al.; File No. 202 3033’’ on your
comment and file your comment online
at https://www.regulations.gov by
following the instructions on the webbased form. If you prefer to file your
comment on paper, please mail your
comment to the following address:
Federal Trade Commission, Office of the
Secretary, 600 Pennsylvania Avenue
NW, Mail Stop H–144 (Annex A),
Washington, DC 20580.
FOR FURTHER INFORMATION CONTACT:
Cathlin Tully (202–326–3644), Attorney,
Division of Privacy and Identity
Protection, Bureau of Consumer
Protection, Federal Trade Commission,
600 Pennsylvania Avenue NW,
Washington, DC 20580.
SUPPLEMENTARY INFORMATION: Pursuant
to Section 6(f) of the Federal Trade
Commission Act, 15 U.S.C. 46(f), and
FTC Rule § 2.34, 16 CFR 2.34, notice is
hereby given that the above-captioned
consent agreement containing a consent
order to cease and desist, having been
filed with and accepted, subject to final
approval, by the Commission, has been
placed on the public record for a period
of 30 days. The following Analysis to
Aid Public Comment describes the
terms of the consent agreement and the
allegations in the complaint. An
electronic copy of the full text of the
consent agreement package can be
obtained at https://www.ftc.gov/newsevents/commission-actions.
You can file a comment online or on
paper. For the Commission to consider
your comment, we must receive it on or
SUMMARY:
E:\FR\FM\29FEN1.SGM
29FEN1
khammond on DSKJM1Z7X2PROD with NOTICES
14840
Federal Register / Vol. 89, No. 41 / Thursday, February 29, 2024 / Notices
before April 1, 2024. Write ‘‘Avast
Limited, et al.; File No. 202 3033,’’ on
your comment. Your comment—
including your name and your state—
will be placed on the public record of
this proceeding, including, to the extent
practicable, on the https://
www.regulations.gov website.
Because of heightened security
screening, postal mail addressed to the
Commission will be subject to delay. We
strongly encourage you to submit your
comments online through the https://
www.regulations.gov website. If you
prefer to file your comment on paper,
write ‘‘Avast Limited, et al.; File No. 202
3033’’ on your comment and on the
envelope, and mail your comment to the
following address: Federal Trade
Commission, Office of the Secretary,
600 Pennsylvania Avenue NW, Mail
Stop H–144 (Annex A), Washington, DC
20580.
Because your comment will be placed
on the publicly accessible website at
https://www.regulations.gov, you are
solely responsible for making sure your
comment does not include any sensitive
or confidential information. In
particular, your comment should not
include sensitive personal information,
such as your or anyone else’s Social
Security number; date of birth; driver’s
license number or other state
identification number, or foreign
country equivalent; passport number;
financial account number; or credit or
debit card number. You are also solely
responsible for making sure your
comment does not include sensitive
health information, such as medical
records or other individually
identifiable health information. In
addition, your comment should not
include any ‘‘trade secret or any
commercial or financial information
which . . . is privileged or
confidential’’—as provided by section
6(f) of the FTC Act, 15 U.S.C. 46(f), and
FTC Rule § 4.10(a)(2), 16 CFR
4.10(a)(2)—including competitively
sensitive information such as costs,
sales statistics, inventories, formulas,
patterns, devices, manufacturing
processes, or customer names.
Comments containing material for
which confidential treatment is
requested must be filed in paper form,
must be clearly labeled ‘‘Confidential,’’
and must comply with FTC Rule
§ 4.9(c). In particular, the written
request for confidential treatment that
accompanies the comment must include
the factual and legal basis for the
request and must identify the specific
portions of the comment to be withheld
from the public record. See FTC Rule
§ 4.9(c). Your comment will be kept
confidential only if the General Counsel
VerDate Sep<11>2014
16:39 Feb 28, 2024
Jkt 262001
grants your request in accordance with
the law and the public interest. Once
your comment has been posted on the
https://www.regulations.gov website—as
legally required by FTC Rule § 4.9(b)—
we cannot redact or remove your
comment from that website, unless you
submit a confidentiality request that
meets the requirements for such
treatment under FTC Rule § 4.9(c), and
the General Counsel grants that request.
Visit the FTC website at https://
www.ftc.gov to read this document and
the news release describing the
proposed settlement. The FTC Act and
other laws the Commission administers
permit the collection of public
comments to consider and use in this
proceeding, as appropriate. The
Commission will consider all timely
and responsive public comments it
receives on or before April 1, 2024. For
information on the Commission’s
privacy policy, including routine uses
permitted by the Privacy Act, see
https://www.ftc.gov/site-information/
privacy-policy.
Analysis of Proposed Consent Order To
Aid Public Comment
The Federal Trade Commission (the
‘‘Commission’’ or ‘‘FTC’’) has accepted,
subject to final approval, an agreement
containing consent order from Avast
Limited, Avast Software s.r.o., and
Jumpshot, Inc. (‘‘Respondents’’). The
proposed consent order (‘‘Proposed
Order’’) has been placed on the public
record for 30 days for receipt of
comments by interested persons.
Comments received during this period
will become part of the public record.
After 30 days, the Commission will
again review the agreement, along with
any comments received, and will decide
whether it should withdraw from the
agreement and take appropriate action
or make final the Proposed Order.
The FTC’s proposed complaint
(‘‘Proposed Complaint’’) alleges that
Respondent Avast Limited, a United
Kingdom limited liability company,
together with Respondent Avast
Software s.r.o. (collectively, ‘‘Avast’’), a
Czech Republic limited liability
company, collected consumers’
browsing information through browser
extensions and antivirus software
(‘‘Avast Software’’) installed on
consumers’ computers and mobile
devices. Through Respondent Jumpshot,
Inc. (‘‘Jumpshot’’), Respondents sold
this browsing data to third parties in
non-aggregate, re-identifiable form.
According to the Proposed Complaint,
the Avast Software collected browsing
information from consumers, including
uniform resource locators (URLs) of web
pages visited, the URLs of background
PO 00000
Frm 00041
Fmt 4703
Sfmt 4703
resources, consumers’ search queries,
and cookie values placed by third
parties on consumers’ computers.
Among other things, the Avast Software
collected browsing information
revealing consumers’ religious beliefs,
health concerns, political leanings,
location, financial status, visits to childdirected content, and interest in
prurient content. Respondents
combined this information with
persistent identifiers, including
identifiers created by Respondents that
identified each consumer device
uniquely, increasing the likelihood that
consumers could be reidentified. As
alleged in the Proposed Complaint, in
many instances Respondents failed to
disclose any information about their
collection or sale of browsing
information, and affirmatively
represented that the Avast Software
would ‘‘[b]lock[ ] annoying tracking
cookies that collect data on your
browsing activities’’ and ‘‘[s]hield your
privacy.’’
The Proposed Complaint alleges that
after Avast acquired Jumpshot in 2013,
Avast rebranded Jumpshot in 2014 as an
analytics company. From 2014 to 2020,
the Proposed Complaint alleges,
Jumpshot sold browsing information
collected by the Avast Software to
customers such as consulting firms,
investment companies, advertising
companies, marketing data analytics
companies, individual brands, search
engine optimization firms, and data
brokers. The Proposed Complaint
alleges that, while Respondents
purported to remove consumers’
identifying information before
transferring browsing information to
Jumpshot, the proprietary algorithm
Avast developed and used to do so was
not sufficient to anonymize the data,
which Jumpshot then sold in nonaggregate form to its customers through
a variety of products. In total, the
Proposed Complaint alleges that
Respondents sold consumers’ browsing
information, and insights derived from
such data, to more than 100 customers,
earning tens of millions in gross
revenues. After receiving the FTC’s civil
investigative demand, Respondents shut
down Jumpshot’s operations ‘‘with
immediate effect.’’
The Commission’s three-count
Proposed Complaint alleges that
Respondents violated section 5(a) of the
FTC Act by: (1) unfairly collecting
consumers’ browsing information,
storing that information in granular
form indefinitely, and selling that
information in granular form to third
parties, without adequate notice and
without consumer consent; (2)
representing that the Avast Software
E:\FR\FM\29FEN1.SGM
29FEN1
Federal Register / Vol. 89, No. 41 / Thursday, February 29, 2024 / Notices
khammond on DSKJM1Z7X2PROD with NOTICES
would stop the collection and sale of
consumers’ browsing information but
failing to disclose, or to disclose
adequately, that Respondents, through
the Avast Software, collected and sold
consumers’ browsing information; and
(3) misrepresenting that consumers’
browsing information would be
transferred to Respondent Jumpshot and
to third parties only in aggregate and
anonymous form.
With respect to the first count, the
Proposed Complaint alleges
Respondents’ practices caused, or are
likely to cause, substantial injury to
consumers that is not outweighed by
countervailing benefits to consumers or
competition and is not reasonably
avoidable by consumers themselves.
The vast majority of consumers would
not know the Avast Software would
surveil their every move on the internet
or their browsing information might be
sold to more than 100 third parties in
granular, re-identifiable form. Such
practices constitute unfair acts or
practices under Section 5 of the FTC
Act.
With respect to the second count, the
Proposed Complaint alleges
Respondents claimed the Avast
Software would stop the collection and
sale of consumers’ browsing
information. The Proposed Complaint
alleges that, in reality, and as noted
above, Respondents’ software collected
consumers’ browsing information which
Respondents then sold to third parties.
Respondent’s failure to disclosure that
material information was deceptive
under Section 5 of the FTC Act.
With respect to the third count, the
Proposed Complaint alleges
Respondents claimed consumers’
browsing information would be
transferred to Respondent Jumpshot and
to third parties only in aggregate and
anonymous form. The Proposed
Complaint alleges that, in reality, and as
noted above, consumers’ browsing
information was transferred to
Respondent Jumpshot and sold to third
parties in non-aggregate and nonanonymous form. Such representations
were, therefore, deceptive under Section
5 of the FTC Act.
Summary of the Proposed Order With
Respondents
The Proposed Order contains
injunctive relief designed to prevent
Respondents from engaging in the same
or similar acts or practices in the future.
Part I prohibits Respondents from
selling, licensing, transferring, sharing,
or otherwise disclosing to third parties
for advertising: (1) browsing information
from Avast products; (2) products or
services derived from such browsing
VerDate Sep<11>2014
16:39 Feb 28, 2024
Jkt 262001
information; or (3) models or algorithms
derived from such data. This provision
further requires Respondents to obtain
affirmative express consent from
consumers before Respondents use
browsing data for third-party
advertising, and to obtain affirmative
express consent from consumers using
non-Avast branded products before
selling, licensing, transferring, sharing,
or otherwise disclosing to third parties
browsing information collected by such
products for advertising.
Part II prohibits Respondents from
misrepresenting: (1) the purpose of their
collection, use, disclosure, or
maintenance of Covered Information
(i.e., information from or about a
consumer or their device, including
browsing information); (2) the extent to
which Covered Information is
aggregated or anonymized; and (3) the
extent to which they collect, use,
disclose, or maintain Covered
Information or otherwise protect the
privacy, security, availability,
confidentiality, or integrity of Covered
Information.
Part III requires Respondents to delete
all browsing information that
Respondent Jumpshot received from the
Avast Respondents and related models,
algorithms, and software. This provision
further requires Respondents to instruct
all third parties that received browsing
information from Respondent Jumpshot,
any models or algorithms derived from
such data, and any software developed
to analyze such data, to delete or
destroy such data, models, algorithms,
or software.
Part IV requires that Respondents
provide notice about the FTC’s
complaint and settlement with
Respondents to consumers on the Avast
websites, within Avast products, and
via email to consumers who purchased
or downloaded Avast products between
2014 and 2020. Part V requires that
Respondents establish and implement,
and thereafter maintain, a
comprehensive privacy program that
protects the privacy of consumers’
personal information.
Part VI requires Respondents to obtain
initial and biennial privacy program
assessments by an independent, thirdparty professional for 20 years. Part VII
requires Respondents to disclose all
material facts to the assessor required by
Part VI and prohibits Respondents from
misrepresenting any fact material to the
assessments required by Part VI. Part
VIII requires each Respondent to submit
an annual certification from a senior
officer responsible for compliance with
Part V that the Respondent has
implemented the requirements of the
Proposed Order and is not aware of any
PO 00000
Frm 00042
Fmt 4703
Sfmt 4703
14841
material noncompliance that has not
been corrected or disclosed to the
Commission.
Part IX requires Respondents to pay to
the Commission $16,500,000 in
monetary relief. Part X describes the
procedures and legal rights related to
that payment.
Parts XI–XIV are reporting and
compliance provisions, which include
recordkeeping requirements and
provisions requiring Respondents to
provide information or documents
necessary for the Commission to
monitor compliance. Part XV states that
the Proposed Order will remain in effect
for 20 years, with certain exceptions.
The purpose of this analysis is to
facilitate public comment on the
Proposed Order, and it is not intended
to constitute an official interpretation of
the Proposed Complaint or Proposed
Order, or to modify the Proposed
Order’s terms in any way.
By direction of the Commission.
April J. Tabor,
Secretary.
Statement of Chair Lina M. Khan,
Joined by Commissioner Rebecca Kelly
Slaughter and Commissioner Alvaro M.
Bedoya
A person’s browsing history can
reveal extraordinarily sensitive
information. A record of the websites
someone visits can divulge everything
from someone’s romantic interests,
financial struggles, and unpopular
political views to their weight-loss
efforts, job rejections, and gambling
addiction.
Aware that internet users may want to
protect their browsing history from data
brokers and other trackers, some firms
now market services to provide privacy
protections online. Avast is one such
firm. Since at least 2014, Avast has
distributed browser extensions that it
promoted through promising users
enhanced privacy. It claimed, for
example, that its products would
‘‘block[ ] annoying tracking cookies that
collect data on your browsing activities’’
and ‘‘[p]rotect your privacy by
preventing . . . web services from
tracking your online activity.’’ It also
stated that any sharing of user
information would be in ‘‘anonymous
and aggregate’’ form.1
The Commission’s complaint charges
that these statements by Avast were
deceptive. The complaint details how
Avast collected highly detailed
browsing data from millions of users
1 Complaint, In re Avast Limited, Docket No. C–
XXXX (Feb. 15, 2024) ¶¶ 5–17, 31–39, https://
www.ftc.gov/system/files/ftc_gov/pdf/ComplaintAvast.pdf [hereinafter Avast Complaint].
E:\FR\FM\29FEN1.SGM
29FEN1
14842
Federal Register / Vol. 89, No. 41 / Thursday, February 29, 2024 / Notices
and then, through its subsidiary
Jumpshot, sold those browsing records
to over a hundred clients, including
major advertising firms. Avast also
released this data in individualized, reidentifiable form, allowing these
browsing histories to be traced back to
specific people—in direct contravention
of what Avast had promised.2 While the
FTC’s privacy lawsuits routinely take on
firms that misrepresent their data
practices, Avast’s decision to expressly
market its products as safeguarding
people’s browsing records and
protecting data from tracking only to
then sell those records is especially
galling.3 Moreover, the volume of data
Avast released is staggering: the
complaint alleges that by 2020 Jumpshot
had amassed ‘‘more than eight petabytes
of browsing information dating back to
2014.’’ Indeed, one advertising firm
received detailed browsing information
on 50 percent of Avast’s entire user base
world-wide, spanning the United States,
United Kingdom, Mexico, Australia,
Canada, and Germany.4
The FTC charges that Avast’s conduct
here was not only deceptive, but also an
unfair practice, violating Section 5 of
the FTC Act. Exposing people’s detailed
browsing data in ways that can be traced
back to them marks an invasion of
privacy and is likely to cause substantial
injury. Because it is intrinsically
sensitive, browsing data warrants
heightened protection. Businesses that
sell or share browser history data
without affirmatively obtaining people’s
permission may be in violation of the
law.
Today’s action against Avast further
builds out the Commission’s work
establishing that sensitive data triggers
heightened privacy obligations and a
default presumption against its sharing
or sale. Through a series of cases, the
FTC has been expounding on how firms
2 Id.
at ¶¶ 18–30.
example, the complaint charges that Avast
stated that its software would ‘‘[s]hield your
privacy. Stop anyone and everyone from getting to
your computer.’’ It similarly claimed that some of
its products would allow users to ‘‘[r]eclaim your
browser. Get rid of unwanted extensions and
hackers making money off your searches.’’ Avast
also represented that the Avast Secure Browser is
‘‘Anti-Tracking’’ and ‘‘[p]rotects your privacy by
preventing websites, advertising companies, and
other web services from tracking your online
activity.’’ (Id. at ¶¶ 16–37). In reality, ‘‘many of the
Jumpshot products (or ‘data feeds’) provided thirdparty data buyers with extraordinary detail
regarding how users navigated the internet,
including each web page visited, precise timestamp,
the type of device and browser, and the city, state,
and country. Most of the data feeds included a
unique and persistent device identifier associated
with each particular browser allowing Jumpshot
and the third-party buyer to trace individuals across
multiple domains over time.’’ Id. at ¶ 21.
4 Id. at ¶ 30.
khammond on DSKJM1Z7X2PROD with NOTICES
3 For
VerDate Sep<11>2014
16:39 Feb 28, 2024
Jkt 262001
are legally required to safeguard
sensitive data. Kochava, X-Mode, and
InMarket highlighted the sensitivity of
precise geolocation data.5 In Rite Aid
and Alexa, the FTC highlighted the
sensitivity of biometric data, such as
facial attributes and voice recordings of
children.6 And in GoodRx, BetterHelp,
and Premom, we underscored the
heightened sensitivity of people’s health
information.7 Today, we underscore the
sensitivity of yet another type of
information: people’s browsing records.
Across these cases, we have
established that businesses by default
cannot sell people’s sensitive data or
disclose it to third parties for
advertising purposes. We have also
pursued bright-line bans. In Rite Aid,
where we alleged that Rite Aid used
unfair and discriminatory facial
recognition software, we are seeking to
ban its use of facial recognition for five
5 See Press Release, Fed. Trade Comm’n, FTC
Sues Kochava for Selling Data That Tracks People
at Reproductive Health Clinics, Places of Worship,
and Other Sensitive Locations (Aug. 29, 2022),
https://www.ftc.gov/news-events/news/pressreleases/2022/08/ftc-sues-kochava-selling-datatracks-people-reproductive-health-clinics-placesworship-other; Press Release, Fed. Trade Comm’n,
FTC Order Prohibits Data Broker X-Mode Social
and Outlogic from Selling Sensitive Location Data
(Jan. 9, 2024), https://www.ftc.gov/news-events/
news/press-releases/2024/01/ftc-order-prohibitsdata-broker-x-mode-social-outlogic-sellingsensitive-location-data; Press Release, Fed. Trade
Comm’n, FTC Order Will Ban InMarket From
Selling Precise Consumer Location Data (Jan. 18,
2024), https://www.ftc.gov/news-events/news/pressreleases/2024/01/ftc-order-will-ban-inmarketselling-precise-consumer-location-data.
6 See Press Release, Fed. Trade Comm’n, Rite Aid
Banned From Using AI Facial Recognition After
FTC Says Retailer Deployed Technology Without
Reasonable Safeguards (Dec. 19, 2023), https://
www.ftc.gov/news-events/news/press-releases/2023/
12/rite-aid-banned-using-ai-facial-recognition-afterftc-says-retailer-deployed-technology-without; Press
Release, Fed. Trade Comm’n, FTC and DOJ Charge
Amazon with Violating Children’s Privacy Law by
Keeping Kids’ Alexa Voice Recordings Forever and
Undermining Parents’ Deletion Requests (May 31,
2023), https://www.ftc.gov/news-events/news/pressreleases/2023/05/ftc-doj-charge-amazon-violatingchildrens-privacy-law-keeping-kids-alexa-voicerecordings-forever.
7 See Press Release, Fed. Trade Comm’n, FTC
Enforcement Action to Bar GoodRx from Sharing
Consumers’ Sensitive Health Info for Advertising
(Feb. 1, 2023), https://www.ftc.gov/news-events/
news/press-releases/2023/02/ftc-enforcementaction-bar-goodrx-sharing-consumers-sensitivehealth-info-advertising; Press Release, Fed. Trade
Comm’n, FTC Gives Final Approval to Order
Banning BetterHelp from Sharing Sensitive Health
Data for Advertising, Requiring It to Pay $7.8
Million (July 14, 2023), https://www.ftc.gov/newsevents/news/press-releases/2023/07/ftc-gives-finalapproval-order-banning-betterhelp-sharingsensitive-health-data-advertising; Press Release,
Fed. Trade Comm’n, Ovulation Tracking App
Premom Will be Barred from Sharing Health Data
for Advertising Under Proposed FTC Order (May
17, 2023), https://www.ftc.gov/news-events/news/
press-releases/2023/05/ovulation-tracking-apppremom-will-be-barred-sharing-health-dataadvertising-under-proposed-ftc.
PO 00000
Frm 00043
Fmt 4703
Sfmt 4703
years. In a trio of matters, GoodRx,
BetterHelp, and Premom—all cases
where health apps promised to keep
secure users’ highly personal health
information but then turned around and
sold that data to third parties for
advertising purposes—we banned those
companies from selling consumers’
health information for such purposes.
Here, we have obtained a similar ban,
for the first time, with respect to a nonhealth service. Today’s order also
secures $16.5 million in relief—the
highest monetary remedy in a de novo
privacy violation case.
I am very grateful to the Division of
Privacy and Identity Protection for their
terrific work to protect Americans from
privacy invasions and commercial
surveillance, especially as it concerns
their most sensitive data.
[FR Doc. 2024–04257 Filed 2–28–24; 8:45 am]
BILLING CODE 6750–01–P
GENERAL SERVICES
ADMINISTRATION
[OMB Control No. 3090–0291; Docket No.
2024–0001; Sequence No. 3]
Information Collection; Federal
Funding Accountability and
Transparency Act Sub-Award
Reporting System Registration
Requirements for Prime Grant
Awardees
Office of the Integrated Award
Environment, General Services
Administration (GSA).
ACTION: Notice of request for public
comments regarding an extension to an
existing OMB clearance.
AGENCY:
Under the provisions of the
Paperwork Reduction Act of 1995, the
Regulatory Secretariat Division will be
submitting to the Office of Management
and Budget (OMB) a request to review
and approve a renewal of the currently
approved information collection
requirement regarding FSRS
Registration Requirements for Prime
Grant Awardees.
DATES: Submit comments on or before
April 29, 2024.
ADDRESSES: Submit comments
identified by Information Collection
3090–0291, FSRS Registration
Requirements for Prime Grant Awardees
to https://www.regulations.gov. Submit
comments via the Federal eRulemaking
portal by searching OMB control
number 3090–0291. Select the link
‘‘Comment Now’’ that corresponds with
‘‘Information Collection 3090–0291,
FSRS Registration Requirements for
Prime Grant Awardees.’’ Follow the
SUMMARY:
E:\FR\FM\29FEN1.SGM
29FEN1
Agencies
[Federal Register Volume 89, Number 41 (Thursday, February 29, 2024)]
[Notices]
[Pages 14839-14842]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2024-04257]
=======================================================================
-----------------------------------------------------------------------
FEDERAL TRADE COMMISSION
[File No. 202 3033]
Avast Limited et al.; Analysis of Proposed Consent Order To Aid
Public Comment
AGENCY: Federal Trade Commission.
ACTION: Proposed consent agreement; request for comment.
-----------------------------------------------------------------------
SUMMARY: The consent agreement in this matter settles alleged
violations of federal law prohibiting unfair or deceptive acts or
practices. The attached Analysis of Proposed Consent Order to Aid
Public Comment describes both the allegations in the complaint and the
terms of the consent order--embodied in the consent agreement--that
would settle these allegations.
DATES: Comments must be received on or before April 1, 2024.
ADDRESSES: Interested parties may file comments online or on paper by
following the instructions in the Request for Comment part of the
SUPPLEMENTARY INFORMATION section below. Please write ``Avast Limited,
et al.; File No. 202 3033'' on your comment and file your comment
online at https://www.regulations.gov by following the instructions on
the web-based form. If you prefer to file your comment on paper, please
mail your comment to the following address: Federal Trade Commission,
Office of the Secretary, 600 Pennsylvania Avenue NW, Mail Stop H-144
(Annex A), Washington, DC 20580.
FOR FURTHER INFORMATION CONTACT: Cathlin Tully (202-326-3644),
Attorney, Division of Privacy and Identity Protection, Bureau of
Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue
NW, Washington, DC 20580.
SUPPLEMENTARY INFORMATION: Pursuant to Section 6(f) of the Federal
Trade Commission Act, 15 U.S.C. 46(f), and FTC Rule Sec. 2.34, 16 CFR
2.34, notice is hereby given that the above-captioned consent agreement
containing a consent order to cease and desist, having been filed with
and accepted, subject to final approval, by the Commission, has been
placed on the public record for a period of 30 days. The following
Analysis to Aid Public Comment describes the terms of the consent
agreement and the allegations in the complaint. An electronic copy of
the full text of the consent agreement package can be obtained at
https://www.ftc.gov/news-events/commission-actions.
You can file a comment online or on paper. For the Commission to
consider your comment, we must receive it on or
[[Page 14840]]
before April 1, 2024. Write ``Avast Limited, et al.; File No. 202
3033,'' on your comment. Your comment--including your name and your
state--will be placed on the public record of this proceeding,
including, to the extent practicable, on the https://www.regulations.gov website.
Because of heightened security screening, postal mail addressed to
the Commission will be subject to delay. We strongly encourage you to
submit your comments online through the https://www.regulations.gov
website. If you prefer to file your comment on paper, write ``Avast
Limited, et al.; File No. 202 3033'' on your comment and on the
envelope, and mail your comment to the following address: Federal Trade
Commission, Office of the Secretary, 600 Pennsylvania Avenue NW, Mail
Stop H-144 (Annex A), Washington, DC 20580.
Because your comment will be placed on the publicly accessible
website at https://www.regulations.gov, you are solely responsible for
making sure your comment does not include any sensitive or confidential
information. In particular, your comment should not include sensitive
personal information, such as your or anyone else's Social Security
number; date of birth; driver's license number or other state
identification number, or foreign country equivalent; passport number;
financial account number; or credit or debit card number. You are also
solely responsible for making sure your comment does not include
sensitive health information, such as medical records or other
individually identifiable health information. In addition, your comment
should not include any ``trade secret or any commercial or financial
information which . . . is privileged or confidential''--as provided by
section 6(f) of the FTC Act, 15 U.S.C. 46(f), and FTC Rule Sec.
4.10(a)(2), 16 CFR 4.10(a)(2)--including competitively sensitive
information such as costs, sales statistics, inventories, formulas,
patterns, devices, manufacturing processes, or customer names.
Comments containing material for which confidential treatment is
requested must be filed in paper form, must be clearly labeled
``Confidential,'' and must comply with FTC Rule Sec. 4.9(c). In
particular, the written request for confidential treatment that
accompanies the comment must include the factual and legal basis for
the request and must identify the specific portions of the comment to
be withheld from the public record. See FTC Rule Sec. 4.9(c). Your
comment will be kept confidential only if the General Counsel grants
your request in accordance with the law and the public interest. Once
your comment has been posted on the https://www.regulations.gov
website--as legally required by FTC Rule Sec. 4.9(b)--we cannot redact
or remove your comment from that website, unless you submit a
confidentiality request that meets the requirements for such treatment
under FTC Rule Sec. 4.9(c), and the General Counsel grants that
request.
Visit the FTC website at https://www.ftc.gov to read this document
and the news release describing the proposed settlement. The FTC Act
and other laws the Commission administers permit the collection of
public comments to consider and use in this proceeding, as appropriate.
The Commission will consider all timely and responsive public comments
it receives on or before April 1, 2024. For information on the
Commission's privacy policy, including routine uses permitted by the
Privacy Act, see https://www.ftc.gov/site-information/privacy-policy.
Analysis of Proposed Consent Order To Aid Public Comment
The Federal Trade Commission (the ``Commission'' or ``FTC'') has
accepted, subject to final approval, an agreement containing consent
order from Avast Limited, Avast Software s.r.o., and Jumpshot, Inc.
(``Respondents''). The proposed consent order (``Proposed Order'') has
been placed on the public record for 30 days for receipt of comments by
interested persons. Comments received during this period will become
part of the public record. After 30 days, the Commission will again
review the agreement, along with any comments received, and will decide
whether it should withdraw from the agreement and take appropriate
action or make final the Proposed Order.
The FTC's proposed complaint (``Proposed Complaint'') alleges that
Respondent Avast Limited, a United Kingdom limited liability company,
together with Respondent Avast Software s.r.o. (collectively,
``Avast''), a Czech Republic limited liability company, collected
consumers' browsing information through browser extensions and
antivirus software (``Avast Software'') installed on consumers'
computers and mobile devices. Through Respondent Jumpshot, Inc.
(``Jumpshot''), Respondents sold this browsing data to third parties in
non-aggregate, re-identifiable form.
According to the Proposed Complaint, the Avast Software collected
browsing information from consumers, including uniform resource
locators (URLs) of web pages visited, the URLs of background resources,
consumers' search queries, and cookie values placed by third parties on
consumers' computers. Among other things, the Avast Software collected
browsing information revealing consumers' religious beliefs, health
concerns, political leanings, location, financial status, visits to
child-directed content, and interest in prurient content. Respondents
combined this information with persistent identifiers, including
identifiers created by Respondents that identified each consumer device
uniquely, increasing the likelihood that consumers could be
reidentified. As alleged in the Proposed Complaint, in many instances
Respondents failed to disclose any information about their collection
or sale of browsing information, and affirmatively represented that the
Avast Software would ``[b]lock[ ] annoying tracking cookies that
collect data on your browsing activities'' and ``[s]hield your
privacy.''
The Proposed Complaint alleges that after Avast acquired Jumpshot
in 2013, Avast rebranded Jumpshot in 2014 as an analytics company. From
2014 to 2020, the Proposed Complaint alleges, Jumpshot sold browsing
information collected by the Avast Software to customers such as
consulting firms, investment companies, advertising companies,
marketing data analytics companies, individual brands, search engine
optimization firms, and data brokers. The Proposed Complaint alleges
that, while Respondents purported to remove consumers' identifying
information before transferring browsing information to Jumpshot, the
proprietary algorithm Avast developed and used to do so was not
sufficient to anonymize the data, which Jumpshot then sold in non-
aggregate form to its customers through a variety of products. In
total, the Proposed Complaint alleges that Respondents sold consumers'
browsing information, and insights derived from such data, to more than
100 customers, earning tens of millions in gross revenues. After
receiving the FTC's civil investigative demand, Respondents shut down
Jumpshot's operations ``with immediate effect.''
The Commission's three-count Proposed Complaint alleges that
Respondents violated section 5(a) of the FTC Act by: (1) unfairly
collecting consumers' browsing information, storing that information in
granular form indefinitely, and selling that information in granular
form to third parties, without adequate notice and without consumer
consent; (2) representing that the Avast Software
[[Page 14841]]
would stop the collection and sale of consumers' browsing information
but failing to disclose, or to disclose adequately, that Respondents,
through the Avast Software, collected and sold consumers' browsing
information; and (3) misrepresenting that consumers' browsing
information would be transferred to Respondent Jumpshot and to third
parties only in aggregate and anonymous form.
With respect to the first count, the Proposed Complaint alleges
Respondents' practices caused, or are likely to cause, substantial
injury to consumers that is not outweighed by countervailing benefits
to consumers or competition and is not reasonably avoidable by
consumers themselves. The vast majority of consumers would not know the
Avast Software would surveil their every move on the internet or their
browsing information might be sold to more than 100 third parties in
granular, re-identifiable form. Such practices constitute unfair acts
or practices under Section 5 of the FTC Act.
With respect to the second count, the Proposed Complaint alleges
Respondents claimed the Avast Software would stop the collection and
sale of consumers' browsing information. The Proposed Complaint alleges
that, in reality, and as noted above, Respondents' software collected
consumers' browsing information which Respondents then sold to third
parties. Respondent's failure to disclosure that material information
was deceptive under Section 5 of the FTC Act.
With respect to the third count, the Proposed Complaint alleges
Respondents claimed consumers' browsing information would be
transferred to Respondent Jumpshot and to third parties only in
aggregate and anonymous form. The Proposed Complaint alleges that, in
reality, and as noted above, consumers' browsing information was
transferred to Respondent Jumpshot and sold to third parties in non-
aggregate and non-anonymous form. Such representations were, therefore,
deceptive under Section 5 of the FTC Act.
Summary of the Proposed Order With Respondents
The Proposed Order contains injunctive relief designed to prevent
Respondents from engaging in the same or similar acts or practices in
the future. Part I prohibits Respondents from selling, licensing,
transferring, sharing, or otherwise disclosing to third parties for
advertising: (1) browsing information from Avast products; (2) products
or services derived from such browsing information; or (3) models or
algorithms derived from such data. This provision further requires
Respondents to obtain affirmative express consent from consumers before
Respondents use browsing data for third-party advertising, and to
obtain affirmative express consent from consumers using non-Avast
branded products before selling, licensing, transferring, sharing, or
otherwise disclosing to third parties browsing information collected by
such products for advertising.
Part II prohibits Respondents from misrepresenting: (1) the purpose
of their collection, use, disclosure, or maintenance of Covered
Information (i.e., information from or about a consumer or their
device, including browsing information); (2) the extent to which
Covered Information is aggregated or anonymized; and (3) the extent to
which they collect, use, disclose, or maintain Covered Information or
otherwise protect the privacy, security, availability, confidentiality,
or integrity of Covered Information.
Part III requires Respondents to delete all browsing information
that Respondent Jumpshot received from the Avast Respondents and
related models, algorithms, and software. This provision further
requires Respondents to instruct all third parties that received
browsing information from Respondent Jumpshot, any models or algorithms
derived from such data, and any software developed to analyze such
data, to delete or destroy such data, models, algorithms, or software.
Part IV requires that Respondents provide notice about the FTC's
complaint and settlement with Respondents to consumers on the Avast
websites, within Avast products, and via email to consumers who
purchased or downloaded Avast products between 2014 and 2020. Part V
requires that Respondents establish and implement, and thereafter
maintain, a comprehensive privacy program that protects the privacy of
consumers' personal information.
Part VI requires Respondents to obtain initial and biennial privacy
program assessments by an independent, third-party professional for 20
years. Part VII requires Respondents to disclose all material facts to
the assessor required by Part VI and prohibits Respondents from
misrepresenting any fact material to the assessments required by Part
VI. Part VIII requires each Respondent to submit an annual
certification from a senior officer responsible for compliance with
Part V that the Respondent has implemented the requirements of the
Proposed Order and is not aware of any material noncompliance that has
not been corrected or disclosed to the Commission.
Part IX requires Respondents to pay to the Commission $16,500,000
in monetary relief. Part X describes the procedures and legal rights
related to that payment.
Parts XI-XIV are reporting and compliance provisions, which include
recordkeeping requirements and provisions requiring Respondents to
provide information or documents necessary for the Commission to
monitor compliance. Part XV states that the Proposed Order will remain
in effect for 20 years, with certain exceptions.
The purpose of this analysis is to facilitate public comment on the
Proposed Order, and it is not intended to constitute an official
interpretation of the Proposed Complaint or Proposed Order, or to
modify the Proposed Order's terms in any way.
By direction of the Commission.
April J. Tabor,
Secretary.
Statement of Chair Lina M. Khan, Joined by Commissioner Rebecca Kelly
Slaughter and Commissioner Alvaro M. Bedoya
A person's browsing history can reveal extraordinarily sensitive
information. A record of the websites someone visits can divulge
everything from someone's romantic interests, financial struggles, and
unpopular political views to their weight-loss efforts, job rejections,
and gambling addiction.
Aware that internet users may want to protect their browsing
history from data brokers and other trackers, some firms now market
services to provide privacy protections online. Avast is one such firm.
Since at least 2014, Avast has distributed browser extensions that it
promoted through promising users enhanced privacy. It claimed, for
example, that its products would ``block[ ] annoying tracking cookies
that collect data on your browsing activities'' and ``[p]rotect your
privacy by preventing . . . web services from tracking your online
activity.'' It also stated that any sharing of user information would
be in ``anonymous and aggregate'' form.\1\
---------------------------------------------------------------------------
\1\ Complaint, In re Avast Limited, Docket No. C-XXXX (Feb. 15,
2024) ]] 5-17, 31-39, https://www.ftc.gov/system/files/ftc_gov/pdf/Complaint-Avast.pdf [hereinafter Avast Complaint].
---------------------------------------------------------------------------
The Commission's complaint charges that these statements by Avast
were deceptive. The complaint details how Avast collected highly
detailed browsing data from millions of users
[[Page 14842]]
and then, through its subsidiary Jumpshot, sold those browsing records
to over a hundred clients, including major advertising firms. Avast
also released this data in individualized, re-identifiable form,
allowing these browsing histories to be traced back to specific
people--in direct contravention of what Avast had promised.\2\ While
the FTC's privacy lawsuits routinely take on firms that misrepresent
their data practices, Avast's decision to expressly market its products
as safeguarding people's browsing records and protecting data from
tracking only to then sell those records is especially galling.\3\
Moreover, the volume of data Avast released is staggering: the
complaint alleges that by 2020 Jumpshot had amassed ``more than eight
petabytes of browsing information dating back to 2014.'' Indeed, one
advertising firm received detailed browsing information on 50 percent
of Avast's entire user base world-wide, spanning the United States,
United Kingdom, Mexico, Australia, Canada, and Germany.\4\
---------------------------------------------------------------------------
\2\ Id. at ]] 18-30.
\3\ For example, the complaint charges that Avast stated that
its software would ``[s]hield your privacy. Stop anyone and everyone
from getting to your computer.'' It similarly claimed that some of
its products would allow users to ``[r]eclaim your browser. Get rid
of unwanted extensions and hackers making money off your searches.''
Avast also represented that the Avast Secure Browser is ``Anti-
Tracking'' and ``[p]rotects your privacy by preventing websites,
advertising companies, and other web services from tracking your
online activity.'' (Id. at ]] 16-37). In reality, ``many of the
Jumpshot products (or `data feeds') provided third-party data buyers
with extraordinary detail regarding how users navigated the
internet, including each web page visited, precise timestamp, the
type of device and browser, and the city, state, and country. Most
of the data feeds included a unique and persistent device identifier
associated with each particular browser allowing Jumpshot and the
third-party buyer to trace individuals across multiple domains over
time.'' Id. at ] 21.
\4\ Id. at ] 30.
---------------------------------------------------------------------------
The FTC charges that Avast's conduct here was not only deceptive,
but also an unfair practice, violating Section 5 of the FTC Act.
Exposing people's detailed browsing data in ways that can be traced
back to them marks an invasion of privacy and is likely to cause
substantial injury. Because it is intrinsically sensitive, browsing
data warrants heightened protection. Businesses that sell or share
browser history data without affirmatively obtaining people's
permission may be in violation of the law.
Today's action against Avast further builds out the Commission's
work establishing that sensitive data triggers heightened privacy
obligations and a default presumption against its sharing or sale.
Through a series of cases, the FTC has been expounding on how firms are
legally required to safeguard sensitive data. Kochava, X-Mode, and
InMarket highlighted the sensitivity of precise geolocation data.\5\ In
Rite Aid and Alexa, the FTC highlighted the sensitivity of biometric
data, such as facial attributes and voice recordings of children.\6\
And in GoodRx, BetterHelp, and Premom, we underscored the heightened
sensitivity of people's health information.\7\ Today, we underscore the
sensitivity of yet another type of information: people's browsing
records.
---------------------------------------------------------------------------
\5\ See Press Release, Fed. Trade Comm'n, FTC Sues Kochava for
Selling Data That Tracks People at Reproductive Health Clinics,
Places of Worship, and Other Sensitive Locations (Aug. 29, 2022),
https://www.ftc.gov/news-events/news/press-releases/2022/08/ftc-sues-kochava-selling-data-tracks-people-reproductive-health-clinics-places-worship-other; Press Release, Fed. Trade Comm'n, FTC Order
Prohibits Data Broker X-Mode Social and Outlogic from Selling
Sensitive Location Data (Jan. 9, 2024), https://www.ftc.gov/news-events/news/press-releases/2024/01/ftc-order-prohibits-data-broker-x-mode-social-outlogic-selling-sensitive-location-data; Press
Release, Fed. Trade Comm'n, FTC Order Will Ban InMarket From Selling
Precise Consumer Location Data (Jan. 18, 2024), https://www.ftc.gov/news-events/news/press-releases/2024/01/ftc-order-will-ban-inmarket-selling-precise-consumer-location-data.
\6\ See Press Release, Fed. Trade Comm'n, Rite Aid Banned From
Using AI Facial Recognition After FTC Says Retailer Deployed
Technology Without Reasonable Safeguards (Dec. 19, 2023), https://www.ftc.gov/news-events/news/press-releases/2023/12/rite-aid-banned-using-ai-facial-recognition-after-ftc-says-retailer-deployed-technology-without; Press Release, Fed. Trade Comm'n, FTC and DOJ
Charge Amazon with Violating Children's Privacy Law by Keeping Kids'
Alexa Voice Recordings Forever and Undermining Parents' Deletion
Requests (May 31, 2023), https://www.ftc.gov/news-events/news/press-releases/2023/05/ftc-doj-charge-amazon-violating-childrens-privacy-law-keeping-kids-alexa-voice-recordings-forever.
\7\ See Press Release, Fed. Trade Comm'n, FTC Enforcement Action
to Bar GoodRx from Sharing Consumers' Sensitive Health Info for
Advertising (Feb. 1, 2023), https://www.ftc.gov/news-events/news/press-releases/2023/02/ftc-enforcement-action-bar-goodrx-sharing-consumers-sensitive-health-info-advertising; Press Release, Fed.
Trade Comm'n, FTC Gives Final Approval to Order Banning BetterHelp
from Sharing Sensitive Health Data for Advertising, Requiring It to
Pay $7.8 Million (July 14, 2023), https://www.ftc.gov/news-events/news/press-releases/2023/07/ftc-gives-final-approval-order-banning-betterhelp-sharing-sensitive-health-data-advertising; Press Release,
Fed. Trade Comm'n, Ovulation Tracking App Premom Will be Barred from
Sharing Health Data for Advertising Under Proposed FTC Order (May
17, 2023), https://www.ftc.gov/news-events/news/press-releases/2023/05/ovulation-tracking-app-premom-will-be-barred-sharing-health-data-advertising-under-proposed-ftc.
---------------------------------------------------------------------------
Across these cases, we have established that businesses by default
cannot sell people's sensitive data or disclose it to third parties for
advertising purposes. We have also pursued bright-line bans. In Rite
Aid, where we alleged that Rite Aid used unfair and discriminatory
facial recognition software, we are seeking to ban its use of facial
recognition for five years. In a trio of matters, GoodRx, BetterHelp,
and Premom--all cases where health apps promised to keep secure users'
highly personal health information but then turned around and sold that
data to third parties for advertising purposes--we banned those
companies from selling consumers' health information for such purposes.
Here, we have obtained a similar ban, for the first time, with respect
to a non-health service. Today's order also secures $16.5 million in
relief--the highest monetary remedy in a de novo privacy violation
case.
I am very grateful to the Division of Privacy and Identity
Protection for their terrific work to protect Americans from privacy
invasions and commercial surveillance, especially as it concerns their
most sensitive data.
[FR Doc. 2024-04257 Filed 2-28-24; 8:45 am]
BILLING CODE 6750-01-P