過了一陣子了，可以整理一下資料記錄起來...
報導可以看 PCMag 的「The Cost of Avast's Free Antivirus: Companies Can Spy on Your Clicks」與 Motherboard (VICE) 的「Leaked Documents Expose the Secretive Market for Your Web Browsing Data」這兩篇，大綱先把重點列出來了，Avast 在賣使用者的瀏覽記錄與行為：
Avast is harvesting users' browser histories on the pretext that the data has been 'de-identified,' thus protecting your privacy. But the data, which is being sold to third parties, can be linked back to people's real identities, exposing every click and search they've made.
Avast 利用免費的防毒軟體，蒐集使用者的瀏覽記錄與行為，然後透過 Jumpshot 這家子公司販賣出去：
The Avast division charged with selling the data is Jumpshot, a company subsidiary that's been offering access to user traffic from 100 million devices, including PCs and phones.
算是「免費的最貴」的標準型。另外比較有趣的是「資料賣給了誰」這件事情：
Who else might have access to Jumpshot's data remains unclear. The company's website says it's worked with other brands, including IBM, Microsoft, and Google. However, Microsoft said it has no current relationship with Jumpshot. IBM, on the other hand, has "no record" of being a client of either Avast or Jumpshot. Google did not respond to a request for comment.
Microsoft 說「現在沒有關係」，IBM 說「沒有 client 的記錄」，Google 則是不回應。
然後配合解釋資料長什麼樣子，以及可以怎麼用：
For instance, a single click can theoretically look like this:
Device ID: abc123x Date: 2019/12/01 Hour Minute Second: 12:03:05 Domain: Amazon.com Product: Apple iPad Pro 10.5 - 2017 Model - 256GB, Rose Gold Behavior: Add to Cart
At first glance, the click looks harmless. You can't pin it to an exact user. That is, unless you're Amazon.com, which could easily figure out which Amazon user bought an iPad Pro at 12:03:05 on Dec. 1, 2019. Suddenly, device ID: 123abcx is a known user. And whatever else Jumpshot has on 123abcx's activity—from other e-commerce purchases to Google searches—is no longer anonymous.
所以，如果 Google 手上有這個資料，就可以交叉比對自家的記錄，然後得到使用者完整的記錄。
在消息一公開後沒多久後，Avast 就宣佈關閉 Jumpshot，感覺連被抓包後的反應動作都超流暢，一臉就是排練過：「A message from Avast CEO Ondrej Vlcek」。
看了一下，Avast 旗下還有 AVG，還有個 VPN 服務...
