Antivirus firm Avast Software s.r.o., the owner of popular free products such as AVG and Avast Antivirus, is under investigation in its home country, the Czech Republic, for allegedly selling the browser history of its users to outside companies.

The allegations that Avast was harvesting user browser history and selling it via a subsidiary called Jumpshot Inc. surfaced in January. Although the sale of anonymized data by companies providing free products is not unusual, it was claimed that the data being sold could be tied to individual users because it included a unique identifier Avast applied to each user.

Avast responded to the revelation by apologizing Jan. 30 and announcing that it was closing down Jumpshot. “The bottom line is that any practices that jeopardize user trust are unacceptable to Avast,” Avast Chief Executive Officer Ondrej Vlcek said at the time. “We are vigilant about our users’ privacy, and we took quick action to begin winding down Jumpshot’s operations after it became evident that some users questioned the alignment of data provision to Jumpshot with our mission and principles that define us as a Company.”

That step, however, was not enough to avoid regulatory scrutiny with the Czech Republic’s Office for Personal Data Protection now launching an investigation into the sale of the data. The Czech Republic is a member of the European Union and hence bound by the EU’s General Data Protection Regulation that protects user data.

“At the moment we are collecting information on the whole case,” Ivana Janu, president of the Czech Office for Personal Data Protection, said in a statement. “There is a suspicion of a serious and extensive breach of the protection of users’ personal data.”

Avast confirmed that it was under investigation, telling PCMag that “we are in receipt of the DPA’s request and we will diligently work with the DPA in full cooperation.”

If found guilty of breaching GDPR, Avast could face serious penalties. Under the regulation, companies can face fines of up to 10 million Euros ($10.87 million) or up to 2% of its entire global revenue of the preceding fiscal year, whichever is higher.

Photo: matusiak/Flickr