Avast Fined 351 Million CZK for GDPR Violation
Summary
The Czech Office for Personal Data Protection issued a final and binding decision imposing a fine of 351 million CZK on Avast Software s.r.o. for unlawful GDPR violations. The DPA found that Avast transferred pseudonymized internet browsing history tied to unique identifiers from approximately 100 million users to its subsidiary Jumpshot during 2019, despite informing users the data was anonymous for trend analytics. The DPA determined the data was not properly anonymised and could be re-identified, and the processing purpose extended beyond the claimed statistical analytics.
The DPA's core finding — that pseudonymized browsing data tied to a unique identifier is not anonymised under GDPR — is the operative compliance point for any company relying on anonymisation claims to shield data transfers. Firms that share or monetise user behavioural data with third parties, or that have claimed anonymisation without technical evidence of irreversibility, should audit whether their practices meet the standard this decision establishes.
What changed
The Czech DPA issued a final and binding decision imposing a 351 million CZK fine on Avast Software for GDPR violations involving the transfer of pseudonymized browsing data from approximately 100 million users to Jumpshot. The DPA found that Avast misled users by claiming the transferred data was anonymised when re-identification was possible, and that the true purpose extended beyond stated statistical analytics. The decision was coordinated with other EU supervisory authorities under the One Stop Shop mechanism due to cross-border processing.
Companies processing EU personal data — particularly those relying on claimed anonymisation or pseudonymisation to exempt data from GDPR — should review their anonymisation standards and ensure any third-party data sharing aligns with stated processing purposes and user disclosures. The DPA's reasoning that even pseudonymized browsing data tied to a unique identifier does not constitute adequate anonymisation provides regulatory context for data sharing practices across the EU.
Penalties
351 million CZK
Archived snapshot
Apr 20, 2026GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.
Czech DPA imposed fine of 351 million CZK for GDPR infringement
- Home
- News
- Business communication
- Article Date published
15.4.2024
Avast Software s.r.o. was fined 351 million CZK by the Office for Personal Data Protection in a final and binding decision. The Office imposed said fine for an unlawful processing of personal data of users of its Avast antivirus program and its browser extensions which verifiably took place during a period in 2019.
Avast processes personal data of the users of its antivirus software when it provides services of this software. It transferred a part of these data, which related to roughly 100 million of its users, to Jumpshot INC. during the period under review in 2019, especially pseudonymized internet browsing history tied to a unique identifier. Jumpshot presented itself as a company that, among other things, granted data access to “marketers” who were provided with “insights into online consumer behaviour” and offered following of “user journeys at the atomic level”.
The users were erroneously informed about transfer of anonymous data for the purpose of trend analytics by Avast. Although Avast stated that it used robust anonymisation techniques, it was proved that data transferred from individual antivirus software installations were not anonymised, since reidentification of at least a part of the data subjects based on the transferred data could occur. Furthermore, the purpose of processing these data was not (merely) to create statistical analyses as Avast claimed.
**"The Office put an emphasis in the decision on the fact that Avast is one of foremost experts on cybersecurity that offers tools for data and privacy protection to the public. Its customers could not have expected that this company in particular would transfer their personal data. That is, data based on which not only an identity of someone can be discovered but also their interests, personal preferences, residence, wealth, profession, and other data concerning their privacy,”
stated about the decision President of the Czech Office for Personal Data Protection Jiří Kaucký.
Due to the fact that this was a case of cross-border processing of personal data of clients across the whole European Union, the case was handled together with other concerned EU supervisory authorities within cooperation mechanism (One Stop Shop).
More news
Read more news.
No more items All news
Mentioned entities
Parties
Related changes
Get daily alerts for Czech UOOU
Daily digest delivered to your inbox.
Free. Unsubscribe anytime.
About this page
Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission
Source document text, dates, docket IDs, and authority are extracted directly from UOOU.
The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.
Classification
Who this affects
Taxonomy
Browse Categories
Get alerts for this source
We'll email you when Czech UOOU publishes new changes.
Subscribed!
Optional. Filters your digest to exactly the updates that matter to you.