Avast vs QRsafer: What the $16.5M FTC Fine Means for Your Privacy

Avast vs QRsafer at a glance

What the FTC found

On February 22, 2024, the Federal Trade Commission issued a consent order against Avast Limited and fined the company $16.5 million. The FTC's complaint alleged that Avast, through its subsidiary Jumpshot, collected detailed browsing data from users of Avast's browser extensions and security software and sold it to more than 100 companies — including advertising platforms, data brokers, and market research firms.

The data sold was described as highly granular: individual URLs visited, search queries, timestamps, and device identifiers that could be used to reconstruct detailed profiles of user behavior. The FTC alleged Avast did this without adequate disclosure, and that the privacy policies users saw didn't clearly convey that their browsing activity would be sold commercially.

The Czech Data Protection Authority issued a separate fine of €13.9 million for GDPR violations related to the same conduct.

What makes this particularly notable is the context: Avast was marketing its products — including Avast Free Antivirus and its browser tools — as privacy and security software. Users who installed Avast specifically to protect themselves were, according to regulators, having their browsing behavior harvested and monetized.

What Avast's QR scanner looks like today

Avast's dedicated standalone QR Scanner app has been discontinued and removed from its product portfolio. If you search for it, you won't find it as a standalone download.

QR scanning is now buried inside Avast Mobile Security — a broader security suite. To use it, you need to install the full Avast suite, navigate into the app, and accept its data practices. The suite operates on a freemium model that gates certain features behind a subscription and encourages account creation.

For users who just want to check whether a QR code is safe before scanning it — a simple, one-step task — this is a significant amount of overhead. And given Avast's regulatory history, handing the full Avast suite access to your device raises reasonable questions about data handling going forward.

This is the same broader pattern behind physical-world attacks like fake parking meter QR codes: trust in an app or tool gets weaponized. In Avast's case, users trusted the brand's privacy positioning while regulators found a different story.

How QRsafer handles privacy differently

QRsafer was designed around a simple principle: a QR scanner should scan QR codes, not profile the person holding the phone. Every privacy decision follows from that.

• No account, ever. QRsafer uses anonymous device-based identity. There is no email address, no password, no profile. There's nothing to associate scan history with a real person.
• No PII collected. QRsafer does not collect purchase data, browsing history, or behavioral data about you. The URL you scan is checked — it isn't stored and sold.
• Location is strictly opt-in. The only way location enters the picture is if you choose to report a QR code you found in the real world as dangerous. That tap is optional, and location sharing for that feature is explicitly opt-in.
• Premium verified on-device. If you upgrade to premium, the transaction is handled through Apple and Superwall on your device. No account credentials pass through QRsafer servers, and your subscription status isn't tied to an email address.
• No data sold. There is no Jumpshot-equivalent at QRsafer. No third-party data licensing, no behavioral advertising partnerships.

For a broader view of what happens when you interact with a malicious QR code, see what happens if you scan a fake QR code. And if you've already scanned something suspicious, here's the step-by-step recovery guide.

Frequently asked questions