Does Your Antivirus Spy on You? The Privacy Policies, Exposed

I had a weird thought last week.

My antivirus has full access to every file on my computer. It watches every download. It knows what applications I run and when. Some of them even monitor my web traffic.

That's more access than I give to any other app. More than my email client. More than my browser. More than my banking app.

So I did something nobody apparently does — I read the privacy policies.

Here's what I found.

What I checked

I went through the privacy policies of the six most popular antivirus products:

• Norton (13% US market share)
• McAfee (18% US market share)
• Avast/AVG (8% US market share)
• Kaspersky (banned in US, but still widely used globally)
• Bitdefender
• Windows Defender (23% US market share)

I was looking for three things: what data they collect, who they share it with, and whether you can opt out.

Norton

Norton's privacy notice is long. Really long. Here's what matters.

What they collect: Device information, operating system, installed applications, network data, file metadata, browsing activity (through Norton extensions), and "diagnostic data."

Who sees the data: Norton says they don't "sell or lease" personal data. But they do share data for advertising purposes, which under many state privacy laws amounts to the same thing. Norton is owned by Gen Digital, which also owns Avast, AVG, Avira, CCleaner, and LifeLock. That's a lot of products sharing data under one corporate umbrella.

Can you opt out? Partially. Some data sharing can be disabled. The crypto miner could be turned off. But the baseline telemetry can't be fully disabled while the product is active.

McAfee

McAfee's privacy situation is more straightforward — and more concerning.

What they collect: URLs you visit, search queries, device identifiers, IP address, MAC address, IMEI number (on mobile), installed apps, network traffic metadata, and "information about your interactions with web content."

Who sees it: McAfee explicitly states they share information with third parties for interest-based advertising. They use your browsing behavior to serve you targeted ads.

Avast / AVG

This is the one with a paper trail.

What happened: From 2014 to 2020, Avast collected detailed browsing data from its antivirus users and funneled it through a subsidiary called Jumpshot. Jumpshot packaged and sold this data to corporate clients.

The scale: 100 million devices. Every search, every click, every purchase, on every site. Including adult content — specific videos, search terms, timestamps.

Who bought it: Google, Yelp, Microsoft, McKinsey, Pepsi, Omnicom, Home Depot, Conde Nast. Over 100 companies.

Avast's own marketing promised to "protect consumers' privacy by blocking third-party tracking."

The fine: $16.5 million from the FTC in February 2024. Avast is now permanently banned from selling browsing data for advertising.

AVG was included. Same parent company, same data pipeline.

Is it safe now? Avast says they've cleaned up. But in 2026, European data protection authorities in Germany, France, and the Netherlands launched a coordinated review of Avast's telemetry. Data revenue reportedly accounts for about 20% of Gen Digital's (Avast's parent) total income. Make of that what you will.

Kaspersky

Kaspersky is a different kind of concern. It's not about ads or data brokers — it's about government access.

The U.S. government banned Kaspersky entirely in 2024. Not "we recommend against it." A full, legal ban. No new sales after July 2024, no signature updates after September 2024.

The stated reason: Russia's capability and intent to exploit Russian companies for intelligence purposes. In 2017, classified NSA data was reportedly taken from a contractor's home computer via Kaspersky software.

Kaspersky denies everything. But the U.S. government doesn't ban software products lightly. This was the Commerce Department, not a tech blog's opinion.

Bitdefender

Bitdefender is actually one of the better ones. Their privacy policy claims a "data minimization" principle. They collect OS version, device model, IP address, and hashed device identifiers.

They do have cloud-based analysis features that upload file hashes and, in some cases, suspicious files to their servers. This is standard for threat analysis, but it means some of your data does leave your device.

Compared to the others on this list, Bitdefender is relatively restrained. "Relatively" doing a lot of work in that sentence.

Windows Defender

The go-to recommendation. "Just use Defender, it's free."

It's a capable scanner. But it's a Microsoft product, and Microsoft has a complicated relationship with user data.

Windows telemetry — even at the "Basic" level — collects application usage data, system performance metrics, crash dumps (which can contain document contents), and network connectivity information. A 2023 analysis described the transmitted data as "surprisingly detailed."

Defender itself feeds into Microsoft's broader telemetry ecosystem. It's not selling your data to advertisers. But it is feeding it into one of the largest data collection operations in the world.

The pattern

Here's what I kept seeing across all six:

1. The privacy policy is deliberately long and hard to read. Norton's is thousands of words. McAfee's privacy notice links to other notices that link to other notices. The complexity is the point — most people give up.
2. "Anonymous" data isn't anonymous. The FTC specifically called out Avast's de-identification as faulty. Research has shown repeatedly that "anonymized" browsing data can be re-identified with as few as four data points.
3. Opting out is deliberately difficult. It's never a simple toggle. It's a form, or a support ticket, or buried six clicks deep in settings. McAfee requires a separate data request form.
4. The business model requires your data. Free antivirus costs money to run. Threat research, signature databases, infrastructure, support. If users aren't paying, the money comes from data. Even paid products have gotten used to the extra revenue.

What I use now

After reading all of this, I wanted something simple: an antivirus that scans files and shuts up. No browser extensions. No cloud analysis. No account. No telemetry.

I ended up building one. It's called XorShield AV. It runs its own detection engine — several layers working together: known-threat signatures, pattern matching for malware families, and on-device AI for the brand-new stuff. Everything happens locally, the way I wanted.

And because the app makes no network connections beyond downloading signature updates, you can verify the privacy claims yourself — just run a network monitor and see. Nothing about your files leaves your device.

But honestly, even if you don't use XorShield AV — please read the privacy policy of whatever antivirus you are using. You might be surprised.

Last updated: April 2026