Is Avast safe, and is AVG safe too?

What Avast and AVG are today

Avast and AVG are not rival companies any more: both are consumer brands owned by Gen Digital. The sentence visible on Gen Digital’s own homepage names only four of its brands together — “Across Norton, Avast, LifeLock and MoneyLion, Gen brings together security, privacy, identity, reputation and financial wellness” — and AVG is not one of the four. The same page’s structured data, read separately from that sentence, names eight consumer brands instead, Avast and AVG both among them. Avast’s privacy hub confirms the link, saying that, as part of Gen, it follows a single notice “broadly applicable across all Gen brands, services and products”. AVG is the older of the two names: its own free-antivirus page says the company “has been protecting users for more than 30 years”, which puts its start before 1996, long before Gen Digital existed as a combined company.

What the free plans include, and what stays paid

Read each company’s own free-antivirus page and the two lists overlap more than they differ. Avast says its free Windows app bundles real-time scanning through File Shield, a Behavior Shield, Web Guard and Mail Shield, a Ransomware Shield that Avast describes as helping “prevent untrusted applications from modifying, deleting, or encrypting” personal files, an intelligent firewall that watches network traffic between the PC and the outside world, a bootable Rescue Disk, and Hack Alerts that warn a user if an email password has turned up in a leak. AVG’s free page makes a parallel set of promises: real-time protection against “viruses, infected emails, scam websites, and more”, a ransomware shield of its own, help keeping a home Wi-Fi network safe from intruders, and the same kind of leaked-password notification Avast offers.

The gap between free and paid is narrower than either company’s headline pitch suggests. Avast’s own FAQ says upgrading to the paid Avast Premium Security (Multi-Device) plan lets a user run the paid app “on up to 10 devices at once across Windows, macOS, Android, and iOS” — a limit on device count, not a missing core feature. Neither company’s free-download page, read in full for this page, states an exact monthly or annual price for its paid tier.

AV-Comparatives’ independent 2025 review adds detail neither company volunteers about itself. During setup, Avast’s installer puts in the Avast Secure Browser and suggests making it the default, then, before the first scan runs, offers an upgrade to the paid version; AVG’s installer runs through the same pattern, and AV-Comparatives says testers “encountered several requests to upgrade to premium throughout the process”. AV-Comparatives also reports that Avast’s Smart Scan surfaces what Avast calls advanced issues, which only a paid subscription can fix, and that “the application will prompt you to purchase one each time you try to fix them”; testers found the repeated prompts intrusive. By default, AV-Comparatives adds, Avast collects user data through third-party analysis services, which the company told the lab is used in-house for product improvement.

Both companies also compare themselves to the antivirus already built into Windows. Avast, which sells a competing product, acknowledges in its own FAQ that Windows Defender “can serve as basic protection for your computer but may not be enough to protect you from new emerging threats”. AVG, also selling a competing product, goes further: its FAQ says Defender “will guard against standard types of malware, but it won’t match the comprehensive security you’ll get with a powerful, third-party antivirus solution like AVG AntiVirus Free”. Neither claim is independent: both come from a company selling the alternative.

What the independent labs say in 2026

The FTC’s own public guidance to consumers does not name individual products: it tells people to use security software, keep it updated or set it to update automatically, and to look for recommendations from independent review sites. Two testing labs publish exactly that kind of independent score every year, and both 2026 reports already cover Avast and AVG.

AV-TEST’s July–August 2026 cycle for Windows 11 home users gave both products the maximum score: Avast Free Antivirus 26.6 reached 6 out of 6 on protection, performance and usability, and so did AVG Antivirus Free, running versions 26.6 and 26.7. In the same cycle, Microsoft’s own Defender Antivirus (Consumer) scored 6/5.5/6, half a point lower on performance than Avast and AVG. AV-TEST explains the label that follows a score like this: “At 17.5 points or higher, AV-TEST also issues the ‘TOP PRODUCT’ award” — a perfect 6/6/6 is worth the full 18, well clear of that line.

AV-Comparatives’ 2025 Summary Report groups Avast and AVG together again: “The 2025 Top-Rated Awards go to Avast, AVG, Bitdefender, ESET, G Data, Kaspersky and Norton”, and both Avast and AVG reached the Advanced+ level in six of their seven individual tests, Advanced in the seventh. AV-Comparatives also found that Avast, AVG, Norton and McAfee had a lower impact on system performance than the other products it tested in 2025, and that in its Advanced Threat Protection test Avast and AVG each blocked 13 of the 15 targeted attacks it ran — behind Bitdefender and ESET, which blocked all 15, but ahead of several other tested products.

The Jumpshot investigation and its 2020 shutdown

The privacy history behind is avast safe starts with a subsidiary, not Avast’s antivirus itself. A joint investigation by Motherboard and PCMag, published 27 January 2020, opened with a direct claim: “An antivirus program used by hundreds of millions of people around the world is selling highly sensitive web browsing data to many of the world’s biggest companies”. The two outlets reported that Jumpshot said it held data from 100 million devices, drawn from a user base Avast itself put at more than 435 million monthly active users, and that one buyer, Omnicom Media Group, paid Jumpshot $2,075,000 for access to its data in 2019, under a separate three-year, 14-market contract that PCMag reported was worth $6.5 million.

The investigation traced the discovery itself to one researcher: security researcher and AdBlock Plus creator Wladimir Palant published a blog post in October 2019 showing that Avast’s browser extension was harvesting user data, after which Mozilla, Opera and Google removed Avast’s and AVG’s extensions from their stores. US Senator Ron Wyden weighed in publicly at the time, saying “I’m concerned that Avast has not yet committed to deleting user data that was collected and shared without the opt-in consent of its users, or to end the sale of sensitive internet browsing data”. Privacy researcher Eric Goldman, a Santa Clara University law professor quoted in the same investigation, put the underlying problem in six words: “It’s almost impossible to de-identify data”. Avast told the two outlets that it ensured Jumpshot did not acquire personal identification information such as names, email addresses or contact details from people using its free antivirus software.

Days after the story ran, on 30 January 2020, Avast announced it would shut down Jumpshot’s operations. Its then CEO, Ondrej Vlcek, said “As CEO of Avast, I feel personally responsible and I would like to apologize to all concerned”. PCMag’s editors later restored the product’s star rating and Editors’ Choice honour, writing “We’ve seen no sign of any inappropriate use of private user data since then, so we’ve taken Avast out of the penalty box”. Avast’s own current settlement FAQ, last updated in October 2026, still frames the closure as voluntary: it says it voluntarily closed Jumpshot and ceased its data collection operation in January 2020, and lists the products the data sharing touched — Avast Online Security, AVG Online Security, Avast Secure Browser, Avast Mobile Security & Virus Cleaner, Avast Free Antivirus and Avast Premium Security — for the period between 1 August 2014 and 30 January 2020.

The FTC’s 2024 order and the 2025 refund

On 22 February 2024, the US Federal Trade Commission said it would require Avast to pay $16.5 million and prohibit the company from selling or licensing web browsing data for advertising purposes, to settle charges that, since at least 2014, Avast had collected consumers’ browsing information through browser extensions and antivirus software and revealed sensitive details such as religious beliefs, health concerns and financial status. The FTC alleged Avast sold that data to more than 100 third parties through Jumpshot, including a contract under which Jumpshot would supply Omnicom, an advertising conglomerate, with browsing data covering half of its customers across the United States, the United Kingdom, Mexico, Australia, Canada and Germany.

The order’s own clauses, quoted directly, go beyond the headline fine. Avast “will be prohibited from selling or licensing any browsing data from Avast-branded products to third parties for advertising purposes”, and separately “must delete the web browsing information transferred to Jumpshot and any products or algorithms Jumpshot derived from that data”. FTC Bureau of Consumer Protection Director Samuel Levine put the commission’s view of the case in one line: “Avast promised users that its products would protect the privacy of their browsing data but delivered the opposite”. Once an order like this becomes final, each future violation of it can carry a civil penalty of up to $51,744.

The commission’s own December 2025 announcement confirms what happened next: the February 2024 proposal became a final settlement in June 2024, under which Avast was required to provide redress to consumers and remained barred from selling or licensing browsing data for advertising. On 2 December 2025, the FTC said it was “sending payments totaling nearly $15.3 million to consumers who were affected by deceptively marketed antivirus software from Avast”, via checks, PayPal and Zelle, to 103,152 Avast customers who had filed a valid claim. Avast itself still disputes the FTC’s version of events: its current settlement FAQ says that, “while we strongly disagree with the FTC’s allegations and characterization of the facts, we are pleased to resolve this matter”.

The Czech fine for the same data

The FTC’s order was not the only penalty over the 2019 Jumpshot transfer. On 15 April 2024, the Czech Office for Personal Data Protection, the UOOU, announced that “Avast Software s.r.o. was fined 351 million CZK by the Office for Personal Data Protection in a final and binding decision” — a separate sanction, under the EU’s GDPR rather than US consumer-protection law, against the Czech entity whose privacy hub lists its principal place of business as Prague. The UOOU found that Avast had transferred browsing data relating to roughly 100 million of its users to Jumpshot during 2019, and concluded that, despite Avast’s claim of using robust anonymisation techniques, the data was not actually anonymised: re-identification of at least some of those users was possible.

UOOU president Jiří Kaucký tied the size of the fine to who Avast is, saying “Avast is one of foremost experts on cybersecurity that offers tools for data and privacy protection to the public” — a company in that position, in the regulator’s view, could not have expected its own customers to assume their personal data would be transferred onward. The fine stands alongside, not instead of, the FTC’s American case: two regulators on two continents reached separate findings and separate figures over the same 2019 data transfer.