The Federal Trade Commission (FTC) announced on Thursday that it will prohibit the antivirus giant Avast from selling consumers’ web browsing data to advertisers. This decision comes after Avast claimed its products would protect users from online tracking. As part of the settlement, Avast will pay $16.5 million, providing redress to users whose sensitive browsing data was improperly sold to advertising companies and data brokers.

Avast, known for its antivirus products, had promised users that its browser extensions would safeguard their privacy by blocking online tracking cookies. However, the FTC alleged that Avast collected customers’ online browsing habits, including web searches and visited websites, over several years. The antivirus company then sold this data through its subsidiary, Jumpshot (now closed), to more than a hundred other companies, generating tens of millions of dollars in revenue.

The regulator revealed that the sold browsing data disclosed sensitive information such as users’ religious beliefs, health concerns, political leanings, location, and more. A previous investigation by Vice News and PCMag in January 2020 exposed Jumpshot for selling highly sensitive web browsing data to major companies like Google, Yelp, Microsoft, Home Depot, and McKinsey. Avast, at the time, had over 430 million active users globally, while Jumpshot claimed access to data from 100 million devices.

In response to the settlement, Avast merged with Norton LifeLock in an $8.1 billion deal in 2021 and now operates under the parent company Gen Digital, which also owns CCleaner. Avast’s subsidiary, Jumpshot, was closed shortly after the Vice-PCMag report. Avast, now part of Gen Digital, disagrees with the government’s allegations but expressed its satisfaction in resolving the matter, stating that the operational provisions of the settlement align with its current privacy and security programs.