What the FTC alleged in the Avast case

The FTC’s February 2024 complaint said Avast’s products claimed to block tracking and protect browsing privacy. It alleged that Avast collected consumers’ browsing information through browser extensions and antivirus software, retained it, and sold browsing information through its subsidiary Jumpshot to third parties without adequate notice and consent. The complaint described the information as detailed and re-identifiable, and alleged that some disclosures described sharing as anonymous or aggregated when the data sold was not in aggregate form.

These are allegations in the complaint. The FTC later finalized a consent order in June 2024. The order includes restrictions on selling or licensing browsing information for advertising, consent requirements for certain data uses, deletion provisions, consumer notifications, and a privacy program. A consent order resolves the FTC matter; this summary does not treat every allegation as a separate court finding.

What to learn from the example

• Read the promise in context. A broad statement such as “protects your privacy” may not answer what information the product collects, for which features, and what happens to it later.
• Trace data beyond collection. Look for retention, vendors, onward sharing, advertising or analytics uses, and whether “anonymous” or “aggregate” is defined and explained.
• Compare the policy with the product experience. Review app-store disclosures, in-product notices, permission prompts, and the current privacy policy for consistent descriptions of the same product and data flows.
• Check what evidence supports a claim. A policy is a statement by the provider. An independent report has a defined scope and period. Neither should be described more broadly than it actually covers.

These are practical review questions prompted by the specific case, not a legal test or a finding about another company.

Why this does not establish whether a VPN keeps logs

Avast’s case concerned antivirus software and browser extensions that collected browsing information. It did not examine a VPN provider’s tunnel servers, connection records, DNS handling, or logging systems. It therefore cannot certify that a VPN logs traffic, or that a “no logs” promise is false. It also does not establish that any current Avast product has the same practices described in the FTC complaint.

For a VPN-specific review, define the categories covered by the claim, read the provider’s current retention and sharing terms, and inspect the actual scope and date of any audit. Record unanswered questions as unknown. Use the VPN no-logs evidence checklist to structure that review. The FTC’s general VPN app privacy checklist also explains how to compare app disclosures and permissions.