The new policy, which takes effect on October 15, makes clear that AVG will collect non-personal data such as “Browsing and search history, including meta data.” AVG says it collects this data “to make money from our free offerings so we can keep them free.”
It’s rare to see a privacy policy that so plainly points out a company’s data collection methods and motivations, but that’s the point. AVG recently put out a press release to celebrate its new document, which indeed uses lots of plain English and includes brief summaries of each section at the top. CEO Gary Kovacs even implored the rest of the tech industry to adopt similarly transparent policies.
But in making its privacy policy easier to understand, AVG has also opened itself up to a backlash. A post on Reddit pointing out AVG’s practices is currently at the top of the site’s Technology section, with thousands of upvotes and (largely angry) comments. Some of the practices mentioned in that Reddit post are things that AVG was already doing, such as keeping a list of installed applications, collecting the device’s advertising ID, tracking search terms, and sharing that non-personal data with third-party partners.
Still, the old policy didn’t draw a fine line between collecting data for malware tracking, and using it for profit. There’s also no mention of collecting users’ browser histories in the old document. We’ve reached out to AVG to clarify how much of the privacy policy is new, and the extent to which the company is collecting browser history.
Why this matters: AVG’s new policy illustrates exactly why companies tend to drown their data collection practices in legalese. There’s no penalty for doing so, and being transparent only invites more outrage. In that sense, AVG at least deserves credit for helping users make informed decisions. Still, the idea of an anti-virus program tracking and monetizing your browsing history is unnerving, and if anything AVG ought to clarify that point further as it finalizes its new privacy policy.