Google removes Avast extensions from Chrome Web Store after it's shown to spy on its users

This article first appeared on: https://ww.9to5google.com/ however it has been edited.

In recent weeks, Adblock Plus creator Wladimir Palant detailed how four browser extensions from Avast and AVG “upload detailed browsing profiles of their users.” Google this evening removed three of those named add-ons from the Chrome Web Store.

AVG is a subsidiary of cybersecurity firm Avast, and both essentially offer the same extensions with different branding. Online Security warns about malicious sites, while SafePrice is a shopping tool.

According to the Adblock Plus developer, all four collect data that “exceeds by far what would be considered necessary or appropriate even for the security extensions.” For example, information sent back includes URLs and whether you previously visited, how you arrived at a page, and what system you’re using:

The data collected here goes far beyond merely exposing the sites that you visit and your search history. Tracking tab and window identifiers as well as your actions allows Avast to create a nearly precise reconstruction of your browsing behavior: how many tabs do you have open, what websites do you visit and when, how much time do you spend reading/watching the contents, what do you click there and when do you switch to another tab.

Some of that collection can be justified, but there are other ways to operate a security extension. For example, Google Safe Browsing checks local lists that are periodically downloaded to provide the same warnings when visiting dangerous pages.

As of this evening, Avast SafePrice, Avast Online Security, and AVG SafePrice have been removed from the Chrome Web Store, though AVG Online Security is still available. This follows similar enforcement by Opera and Firefox earlier this month. However, Avast worked with Mozilla to get both Online Security extensions listed again over the past week by removing unneeded collection, and will presumably issue similar fixes for the Chrome counterparts.

Avast sells collected browsing data that’s useful for discerning shopping habits. This has resulted in Congressional scrutiny about the resulting “failure to protect consumers’ data.” The company has defended the browser data it collects, while arguing that the info retained and sold is anonymized.