ftc – Page 2

Avast ordered to stop selling browsing data from its browsing privacy apps

Avast, avast antivirus, Biz & IT, browsing data, federal trade commission, ftc, jumpshot, Policy, privacy, Security, Tech / Rejus Almole / February 24, 2024

Security, privacy, things of that nature —

Identifiable data included job searches, map directions, “cosplay erotica.”

Kevin Purdy – Feb 23, 2024 8: 37 pm UTC

Getty Images

Avast, a name known for its security research and antivirus apps, has long offered Chrome extensions, mobile apps, and other tools aimed at increasing privacy.

Avast’s apps would “block annoying tracking cookies that collect data on your browsing activities,” and prevent web services from “tracking your online activity.” Deep in its privacy policy, Avast said information that it collected would be “anonymous and aggregate.” In its fiercest rhetoric, Avast’s desktop software claimed it would stop “hackers making money off your searches.”

All of that language was offered up while Avast was collecting users’ browser information from 2014 to 2020, then selling it to more than 100 other companies through a since-shuttered entity known as Jumpshot, according to the Federal Trade Commission. Under a proposed recent FTC order (PDF), Avast must pay $16.5 million, which is “expected to be used to provide redress to consumers,” according to the FTC. Avast will also be prohibited from selling future browsing data, must obtain express consent on future data gathering, notify customers about prior data sales, and implement a “comprehensive privacy program” to address prior conduct.

Reached for comment, Avast provided a statement that noted the company’s closure of Jumpshot in early 2020. “We are committed to our mission of protecting and empowering people’s digital lives. While we disagree with the FTC’s allegations and characterization of the facts, we are pleased to resolve this matter and look forward to continuing to serve our millions of customers around the world,” the statement reads.

Data was far from anonymous

The FTC’s complaint (PDF) notes that after Avast acquired then-antivirus competitor Jumpshot in early 2014, it rebranded the company as an analytics seller. Jumpshot advertised that it offered “unique insights” into the habits of “[m]ore than 100 million online consumers worldwide.” That included the ability to “[s]ee where your audience is going before and after they visit your site or your competitors’ sites, and even track those who visit a specific URL.”

While Avast and Jumpshot claimed that the data had identifying information removed, the FTC argues this was “not sufficient.” Jumpshot offerings included a unique device identifier for each browser, included in data like an “All Clicks Feed,” “Search Plus Click Feed,” “Transaction Feed,” and more. The FTC’s complaint detailed how various companies would purchase these feeds, often with the express purpose of pairing them with a company’s own data, down to an individual user basis. Some Jumpshot contracts attempted to prohibit re-identifying Avast users, but “those prohibitions were limited,” the complaint notes.

The connection between Avast and Jumpshot became broadly known in January 2020, after reporting by Vice and PC Magazine revealed that clients, including Home Depot, Google, Microsoft, Pepsi, and McKinsey, were buying data from Jumpshot, as seen in confidential contracts. Data obtained by the publications showed that buyers could purchase data including Google Maps look-ups, individual LinkedIn and YouTube pages, porn sites, and more. “It’s very granular, and it’s great data for these companies, because it’s down to the device level with a timestamp,” one source told Vice.

The FTC’s complaint provides more detail on how Avast, on its own web forums, sought to downplay its Jumpshot presence. Avast suggested both that only non-aggregated data was provided to Jumpshot and that users were informed during product installation about collecting data to “better understand new and interesting trends.” Neither of these claims proved true, the FTC suggests. And the data collected was far from harmless, given its re-identifiable nature:

For example, a sample of just 100 entries out of trillions retained by Respondents

showed visits by consumers to the following pages: an academic paper on a study of symptoms

of breast cancer; Sen. Elizabeth Warren’s presidential candidacy announcement; a CLE course

on tax exemptions; government jobs in Fort Meade, Maryland with a salary greater than

$100,000; a link (then broken) to the mid-point of a FAFSA (financial aid) application;

directions on Google Maps from one location to another; a Spanish-language children’s

YouTube video; a link to a French dating website, including a unique member ID; and cosplay

erotica.

In a blog post accompanying its announcement, FTC Senior Attorney Lesley Fair writes that, in addition to the dual nature of Avast’s privacy products and Jumpshot’s extensive tracking, the FTC is increasingly viewing browsing data as “highly sensitive information that demands the utmost care.” “Data about the websites a person visits isn’t just another corporate asset open to unfettered commercial exploitation,” Fair writes.

FTC commissioners voted 3-0 to issue the complaint and accept the proposed consent agreement. Chair Lina Khan, along with commissioners Rebecca Slaughter and Alvaro Bedoya, issued a statement on their vote.

Since the time of the FTC’s complaint and its Jumpshot business, Avast has been acquired by Gen Digital, a firm that contains Norton, Avast, LifeLock, Avira, AVG, CCLeaner, and ReputationDefender, among other security businesses.

Disclosure: Condé Nast, Ars Technica’s parent company, received data from Jumpshot before its closure.

Avast ordered to stop selling browsing data from its browsing privacy apps Read More »

Data broker allegedly selling de-anonymized info to face FTC lawsuit after all

data broker, federal trade commission, ftc, geolocation data, kochava, lina khan, online advertising, Online Privacy, personally identifiable information, Policy / Paul Patrick / February 6, 2024

The Federal Trade Commission has succeeded in keeping alive its first federal court case against a geolocation data broker that’s allegedly unfairly selling large quantities of data in violation of the FTC Act.

On Saturday, US District Judge Lynn Winmill denied Kochava’s motion to dismiss an amended FTC complaint, which he said plausibly argued that “Kochava’s data sales invade consumers’ privacy and expose them to risks of secondary harms by third parties.”

Winmill’s ruling reversed a dismissal of the FTC’s initial complaint, which the court previously said failed to adequately allege that Kochava’s data sales cause or are likely to cause a “substantial” injury to consumers.

The FTC has accused Kochava of selling “a substantial amount of data obtained from millions of mobile devices across the world”—allegedly combining precise geolocation data with a “staggering amount of sensitive and identifying information” without users’ knowledge or informed consent. This data, the FTC alleged, “is not anonymized and is linked or easily linkable to individual consumers” without mining “other sources of data.”

Kochava’s data sales allegedly allow its customers—whom the FTC noted often pay tens of thousands of dollars monthly—to target specific individuals by combining Kochava data sets. Using just Kochava data, marketers can create “highly granular” portraits of ad targets such as “a woman who visits a particular building, the woman’s name, email address, and home address, and whether the woman is African-American, a parent (and if so, how many children), or has an app identifying symptoms of cancer on her phone.” Just one of Kochava’s databases “contains ‘comprehensive profiles of individual consumers,’ with up to ‘300 data points’ for ‘over 300 million unique individuals,'” the FTC reported.

This harms consumers, the FTC alleged, in “two distinct ways”—by invading their privacy and by causing “an increased risk of suffering secondary harms, such as stigma, discrimination, physical violence, and emotional distress.”

In its amended complaint, the FTC overcame deficiencies in its initial complaint by citing specific examples of consumers already known to have been harmed by brokers sharing sensitive data without their consent. That included a Catholic priest who resigned after he was outed by a group using precise mobile geolocation data to track his personal use of Grindr and his movements to “LGBTQ+-associated locations.” The FTC also pointed to invasive practices by journalists using precise mobile geolocation data to identify and track military and law enforcement officers over time, as well as data brokers tracking “abortion-minded women” who visited reproductive health clinics to target them with ads about abortion and alternatives to abortion.

“Kochava’s practices intrude into the most private areas of consumers’ lives and cause or are likely to cause substantial injury to consumers,” the FTC’s amended complaint said.

The FTC is seeking a permanent injunction to stop Kochava from allegedly selling sensitive data without user consent.

Kochava considers the examples of consumer harms in the FTC’s amended complaint as “anecdotes” disconnected from its own activities. The data broker was seemingly so confident that Winmill would agree to dismiss the FTC’s amended complaint that the company sought sanctions against the FTC for what it construed as a “baseless” filing. According to Kochava, many of the FTC’s allegations were “knowingly false.”

Ultimately, the court found no evidence that the FTC’s complaints were baseless. Instead of dismissing the case and ordering the FTC to pay sanctions, Winmill wrote in his order that Kochava’s motion to dismiss “misses the point” of the FTC’s filing, which was to allege that Kochava’s data sales are “likely” to cause alleged harms. Because the FTC had “significantly” expanded factual allegations, the agency “easily” satisfied the plausibility standard to allege substantial harms were likely, Winmill said.

Kochava CEO and founder Charles Manning said in a statement provided to Ars that Kochava “expected” Winmill’s ruling and is “confident” that Kochava “will prevail on the merits.”

“This case is really about the FTC attempting to make an end-run around Congress to create data privacy law,” Manning said. “The FTC’s salacious hypotheticals in its amended complaint are mere scare tactics. Kochava has always operated consistently and proactively in compliance with all rules and laws, including those specific to privacy.”

In a press release announcing the FTC lawsuit in 2022, the director of the FTC’s Bureau of Consumer Protection, Samuel Levine, said that the FTC was determined to halt Kochava’s allegedly harmful data sales.

“Where consumers seek out health care, receive counseling, or celebrate their faith is private information that shouldn’t be sold to the highest bidder,” Levine said. “The FTC is taking Kochava to court to protect people’s privacy and halt the sale of their sensitive geolocation information.”

Data broker allegedly selling de-anonymized info to face FTC lawsuit after all Read More »

FTC suggests new rules to shift parents’ burden of protecting kids to websites

biometric data, children's online privacy protection act, children's privacy law, COPPA, federal trade commission, ftc, online data privacy, Policy / Rejus Almole / December 21, 2023

Ending the endless tracking of kids —

FTC seeking public comments on new rules to expand children’s privacy law.

Ashley Belanger – Dec 21, 2023 4: 36 pm UTC

The Federal Trade Commission (FTC) is currently seeking comments on new rules that would further restrict platforms’ efforts to monetize children’s data.

Through the Children’s Online Privacy Protection Act (COPPA), the FTC initially sought to give parents more control over what kinds of information that various websites and apps can collect from their kids. Now, the FTC wants to update COPPA and “shift the burden from parents to providers to ensure that digital services are safe and secure for children,” the FTC’s press release said.

“By requiring firms to better safeguard kids’ data, our proposal places affirmative obligations on service providers and prohibits them from outsourcing their responsibilities to parents,” FTC chair Lina Khan said.

Among proposed rules, the FTC would require websites to turn off targeted advertising by default and prohibit sending push notifications to encourage kids to use services more than they want to. Surveillance in schools would be further restricted, so that data is only collected for educational purposes. And data security would be strengthened by mandating that websites and apps “establish, implement, and maintain a written children’s personal information security program that contains safeguards that are appropriate to the sensitivity of the personal information collected from children.”

Perhaps most significantly, COPPA would also be updated to stop companies from retaining children’s data forever, explicitly stating that “operators cannot retain the information indefinitely.” In a statement, commissioner Alvaro Bedoya called this a “critical protection” at a time when “new, machine learning-fueled systems require ever larger amounts of training data.”

These proposed changes were designed to address “the evolving ways personal information is being collected, used, and disclosed, including to monetize children’s data,” the FTC said.

Keeping up with advancing technology, the FTC said, also requires expanding COPPA’s definition of “personal information” to include biometric identifiers. That change was likely inspired by charges brought against Amazon earlier this year, when the FTC accused Amazon of violating COPPA by retaining tens of thousands of children’s Alexa voice recordings forever.

Once the notice of proposed rulemaking is published to the Federal Register, the public will have 60 days to submit comments. The FTC likely anticipates thousands of parents and stakeholders to weigh in, noting that the last time COPPA was updated in 2019, more than 175,000 comments were submitted.

Endless tracking of kids not a “victimless crime”

Bedoya said that updating the already-expansive children’s privacy law would prevent known harms. He also expressed concern that increasingly these harms are being overlooked, citing a federal judge in California who preliminarily enjoined California’s Age-Appropriate Design Code” in September. That judge had suggested that California’s law was “actually likely to exacerbate” online harm to kids, but Bedoya challenged that decision as reinforcing a “critique that has quietly proliferated around children’s privacy: the idea that many privacy invasions do not actually hurt children.”

For decades, COPPA has protected against the unauthorized or unnecessary collection, use, retention, and disclosure of children’s information, which Bedoya said “endangers children’s safety,” “exposes children and families to hacks and data breaches,” and “allows third-party companies to develop commercial relationships with children that prey on their trust and vulnerability.”

“I think each of these harms, particularly the latter, undermines the idea that the pervasive tracking of children online is [a] ‘victimless crime,'” Bedoya said, adding that “the harms that COPPA sought to prevent remain real, and COPPA remains relevant and profoundly important.”

According to Bedoya, COPPA is more vital than ever, as “we are only at the beginning of an era of biometric fraud.”

Khan characterized the proposed changes as “much-needed” in an “era where online tools are essential for navigating daily life—and where firms are deploying increasingly sophisticated digital tools to surveil children.”

“Kids must be able to play and learn online without being endlessly tracked by companies looking to hoard and monetize their personal data,” Khan said.

FTC suggests new rules to shift parents’ burden of protecting kids to websites Read More »

Report: Meta Wins Bid to Acquire VR Fitness Studio Behind ‘Supernatural’, Awaiting FTC Appeal

antitrust, ftc, Meta, meta antitrust, meta ftc, News, VR Fitness / Rejus Almole / February 2, 2023

In 2021 Meta announced it was set to acquire Within, the studio behind popular VR fitness app Supernatural, however the reportedly $400 million deal became subject to investigations by the Federal Trade Commission (FTC) in respect to Meta’s supposed monopolization of the VR fitness space. Now, according to a Bloomberg report, it appears the FTC has lost an important suit to block Meta’s acquisition of Within.

Unreleased documents from the closed court proceedings appear to vindicate Meta’s acquisition of Within, Bloomberg reports, citing people familiar with the ruling. The sealed decision was made Wednesday morning by US District Judge Edward Davila in San Jose, California, which effectively denies the FTC’s request for a preliminary injunction to block the acquisition.

The final outcome of the trial isn’t entirely official just yet though. It’s said Judge Davila also issued a temporary restraining order with the aim of pausing Meta from closing the transaction for a further week, allowing time for the FTC to make an appeal. Provided the reports are accurate, the chances of the FTC potentially clawing back from the loss seem fairly slim at this point.

Last July, the FTC under sitting Chair Lina Khan revealed it had filed a motion aimed at blocking the deal with a federal court in a 3–2 decision, which aimed at reigning in Meta’s ability to “buy market position instead of earning it on the merits,” FTC Bureau of Competition Deputy Director John Newman said at the time.

Neither Meta nor the FTC has commented on the report regarding Meta’s win. In a statement to the New York Times about the matter in July, Meta called the FTC’s position “based on ideology and speculation, not evidence. The idea that this acquisition would lead to anticompetitive outcomes in a dynamic space with as much entry and growth as online and connected fitness is simply not credible.” Adding that the lawsuit would send “a chilling message to anyone who wishes to innovate in VR.”

Over the past four years, Meta has gone unchallenged in several VR studio acquisitions, including Beat Games (Beat Saber), Sanzaru Games (Asgard’s Wrath), Ready at Dawn (Lone Echo & Echo Arena), Downpour Interactive (Onward), BigBox VR (Population: One), Camouflaj (Marvel’s Iron Man VR), Twisted Pixel (Wilson’s Heart, Path of the Warrior), and Armature Studio (Resident Evil 4 VR port for Quest 2).

In particular, the FTC used Meta’s acquisition of Beat Saber as evidence that the company already had engineers with the skill set to both expand Beat Saber into fitness and to build a VR dedicated fitness app from scratch, an FTC court filing stated, maintaining that buying Within “was not the only way Meta could have developed the production capabilities and expertise needed to create a premium VR fitness experience.”

Report: Meta Wins Bid to Acquire VR Fitness Studio Behind ‘Supernatural’, Awaiting FTC Appeal Read More »

‘Batman VR’ App Allegedly in the Works for Quest, FTC Filing Claims

bat man, batman, batman vr, ftc, Meta, Meta Quest 2, News, quest, Quest 2, VR Game / Rejus Almole / December 3, 2022

Among documents released by the United States Federal Trade Commission (FTC) earlier this week is a claim that Meta’s VR studio Camouflaj, the developers behind Marvel’s Ironman VR, have also planned a Batman VR app for release on Quest.

The apparent leak was found by Janko Roettgers, formerly of Protocol and Variety. The document in whole can be viewed here.

“In September 2022, Meta acquired Camouflaj, which currently developing Ironman and Batman VR apps for Quest.”

The information comes as a part of wider antitrust investigation into Meta’s acquisition of Within, the studio behind the VR fitness app. You can read more about that here.

Last we heard from Camouflaj before the acquisition by Meta, the studio said it had “exciting things on the horizon,” maintaining it was still “all-in on VR.”

As early as May 2022, the studio was hiring for a host of positions to work on its “next exciting AAA project.”

A few months later the studio then released Iron Man VR on Quest 2, releasing it from its two-year exclusivity on PSVR.

Camouflaj hasn’t announced any new projects at this point either. We’ve reached out to Meta for comment and will update when/if we hear back.

‘Batman VR’ App Allegedly in the Works for Quest, FTC Filing Claims Read More »