The updated policy explained that AVG was allowed to collect "non-personal data", which could then be sold to third parties. The new privacy policy comes into effect on 15 October, but AVG explained that the ability to collect search history data had also been included in previous privacy policies, albeit with different wording.
AVG's potential ability to collect and sell browser and search history data placed the company "squarely into the category of spyware", according to Alexander Hanff security expert and chief executive of Think Privacy.
Previous versions of AVG's privacy policy stated it could collect data on "the words you search", but didn't make it clear that browser history data could also be collected and sold to third parties. In a statement AVG said it had updated its privacy policy to be more transparent about how it could collect and use customer data.
An AVG spokesperson told WIRED that in order to continue offering free security software the company
may in the future "employ a variety of means, including subscription, ads and data models."
"Those users who do not want us to use non-personal data in this way will be able to turn it off, without any decrease in the functionality our apps will provide," the spokesperson added. "While AVG has not utilized data models to date, we may, in the future, provided that it is anonymous, non-personal data, and we are confident that our users have sufficient information and control to make an informed choice."