Jumpshot

» see jumpshot.com as it lived, on the wayback machine

~ the obit ~

Jumpshot in 2010 was a friendly thing. David Endler and Pedram Amini, who had known each other since Tulane, built a Windows utility for the specific job of making a relative's computer usable again by stripping out the toolbars and the startup junk. It was sold on being simple enough that you could hand it to someone who did not know what a process was. Avast bought the company in September 2013 and said the point was to put that cleanup technology in front of its four hundred million users.

That part happened. The technology was rebranded GrimeFighter in 2014 and then Avast Cleanup in 2015, and the Jumpshot name came loose from the product it had been attached to. Deren Baker was brought in as CEO of a company called Jumpshot that no longer made the thing Jumpshot made. Around the same time Avast started describing it in public as a marketing analytics company, and the founders left.

What the new Jumpshot sold was the browsing behavior of Avast's users. Free antivirus sits below the browser with permission to see everything crossing the machine, and Avast also shipped browser extensions with the same view. Jumpshot stripped the obvious identifiers off that stream and sold what was left to clients reportedly including Microsoft and Home Depot. It covered roughly a hundred million devices. In July 2019 Ascential paid 60.8 million dollars for a 35 percent stake, which put the whole business near 180 million.

The reason this one lands differently from a dead startup is that free antivirus was the standard answer to a slow Windows machine everywhere, including here. Avast and AVG were two of the names you actually recognized on a Turkish home PC or in an internet cafe, the free install that seemed like the responsible thing to do. The product's business model was never the question anybody asked, and the answer turned out to be sitting one subsidiary away.

~ the rap sheet ~

~ from cleanup tool to data broker ~

The pivot is legible in the language. Avast's 2013 press release is about PC performance magic for grandmothers. A board member's post from May 2015 is about consumer insights, product preference broken out by state, the sort of thing sold to brand managers. Nothing was hidden in those two years. It simply became a different company under a name that still carried the reputation of the old one.

~ the investigation ~

Trouble arrived in stages. In late 2019 the researcher Wladimir Palant published a breakdown of what Avast's browser extensions were sending home, and Mozilla and Opera pulled the extensions from their stores in December. That established the collection. What it did not yet show was the downstream.

On 27 January 2020, PCMag and Vice Motherboard published a joint investigation built on leaked Jumpshot documents. The product at the center of it was the All Clicks Feed, which recorded every click by a device, timestamped and in sequence, across everything from Google searches to porn. Each record carried a persistent device ID. Jumpshot insisted the data was de-identified, and the reporting made the obvious point back: a timestamped click trail through a person's whole week is not anonymous to anyone who holds one other record of where that person was.

~ what got sold ~

Avast announced on 30 January 2020, three days later, that it was terminating Jumpshot's provision of data with immediate effect and winding the business down. Ondrej Vlcek, the CEO, said both companies had acted fully within legal bounds and pointed to the arrival of GDPR in 2018 as something Avast had welcomed. Ascential's stake was bought back at the price it paid. Vendors were promised payment through the wind-down, and a profitable subsidiary with a nine-figure valuation was closed in a single announcement, which is what it costs when the story is about an antivirus company and trust is the only product.

Typing the address now returns a 404 from an nginx server, with a TLS certificate that belongs to somebody else entirely. Avast itself went to NortonLifeLock in a deal announced in August 2021 and closed a year later for over eight billion dollars. In February 2024 the FTC fined it 16.5 million dollars over exactly this and barred it from selling browsing data for advertising. The fine arrived four years after the business it referred to had already been shut.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »