How to Check If Your Antivirus Is Sending Data Home

Your antivirus can see every file on your computer. It can read your documents, watch your downloads, monitor your processes. It has deeper access than your web browser, your email client, or your operating system's own apps. So the question "is my antivirus spying on me?" isn't paranoid. It's practical.

Here's how to answer it. Five steps, all free or cheap, using tools you can set up in under an hour.

Step 1: Install a network monitor

This is the most important step. Privacy policies can lie (or at least mislead). Network traffic doesn't. If your antivirus is sending data somewhere, a network monitor will show you exactly where.

On macOS

LuLu (free, open source) — built by Patrick Wardle at Objective-See. It alerts you every time any application tries to make an outbound network connection. You get the process name, the destination IP, and the domain it's connecting to.

Download it at objective-see.org/products/lulu.html.

Little Snitch ($59 one-time) — the gold standard for macOS network monitoring. More polished than LuLu, with a visual network map, traffic history, and per-process bandwidth tracking. Worth the money if you do this kind of analysis regularly.

On Windows

GlassWire (free tier) — gives you a timeline of which applications connected to which servers, when, and how much data was transferred. The free version does everything you need for this test.

Download at glasswire.com.

Wireshark (free, open source) — the nuclear option. Captures every packet on your network interface. Powerful, but the learning curve is steep. Use GlassWire first; pull out Wireshark if you need to dig deeper into packet contents.

On Linux

nethogs — per-process network bandwidth in your terminal. Install with your package manager:

sudo apt install nethogs    # Debian/Ubuntu
sudo dnf install nethogs    # Fedora
sudo pacman -S nethogs      # Arch

Then run:

sudo nethogs

It shows every process making network connections, in real time, with bandwidth numbers. If your antivirus is sending megabytes somewhere, you'll see it here.

Step 2: Watch for connections that aren't updates

Your antivirus has exactly one legitimate reason to connect to the internet: downloading virus definition updates. That's a connection to the vendor's update server, once or twice a day, pulling down a known file.

Let your network monitor run for 48 hours. Don't change your behavior. Just use your computer normally. Then check the logs.

Here's what you're looking for:

• Analytics domains. If your antivirus is connecting to google-analytics.com, mixpanel.com, amplitude.com, segment.io, or any analytics platform — someone is tracking your usage patterns.
• Ad network domains. Connections to doubleclick.net, facebook.com/tr, amazon-adsystem.com, or programmatic ad exchanges mean your antivirus has advertising integrations. There's no security reason for these connections.
• Data broker domains. These are harder to spot because you won't recognize the names. Look up unfamiliar domains with a WHOIS query. Companies like Tapad, LiveRamp, Oracle Data Cloud (Datalogix), or Acxiom specialize in cross-device tracking and data aggregation. If your antivirus is talking to them, your data is being shared.
• High-frequency connections to the vendor's own servers. One update check per day is normal. Dozens of connections per hour is telemetry — your antivirus is reporting your activity in near real-time.

Step 3: Monitor DNS queries

Even if your antivirus encrypts its traffic (most do now), DNS queries usually leak the destination in plaintext — unless you're running DNS-over-HTTPS or DNS-over-TLS. You can see exactly which domains your antivirus is resolving.

On macOS or Linux, open Terminal and run:

sudo tcpdump -i any port 53 -l 2>/dev/null | tee dns_log.txt

This captures all DNS queries on all network interfaces and writes them to a file. Let it run for an hour while you use your computer normally. Then search the log:

# Look for your antivirus vendor
grep -i "norton\|mcafee\|avast\|avg\|kaspersky" dns_log.txt

# Look for known analytics/ad domains
grep -i "analytics\|doubleclick\|facebook.*tr\|mixpanel\|amplitude\|segment\|tapad" dns_log.txt

When I ran this test with three popular antivirus products, the results ranged from 2 unique domains (the privacy-respecting one) to 47 unique domains in a single hour (the worst offender). That worst offender was resolving analytics endpoints, CDN domains that host tracking pixels, and two domains belonging to data aggregation companies.

On Windows

Windows doesn't have tcpdump built in, but you can use PowerShell to query the DNS client cache:

Get-DnsClientCache | Select-Object Entry, Data | Sort-Object Entry -Unique

Run this periodically (every 10 minutes for an hour) to see what's being resolved. Or use GlassWire, which logs DNS queries per process automatically.

Step 4: Read the privacy policy (strategically)

Nobody wants to read a privacy policy. But you don't have to read the whole thing. Search for five specific phrases:

• "Third parties" — who are they sharing data with, and for what purpose? If the answer includes "advertising" or "marketing," your data is part of their ad business.
• "Interest-based advertising" or "behavioral advertising" — this means they're building profiles from your behavior and targeting ads based on them.
• "Analytics" — what are they measuring? App usage analytics are one thing. Browsing analytics are another.
• "De-identified" or "aggregated" — these are the weasel words. The FTC found that Avast's "de-identification" was inadequate. Research has shown that just four data points can re-identify a "de-identified" user over 95% of the time. When a company says data is "aggregated," ask: aggregated by whom, stored where, and accessible to whom?
• "Opt-out" — if data collection is opt-out (instead of opt-in), most users will never change the default. The company is counting on that.

Paste the privacy policy into a text editor and use Ctrl+F (or Cmd+F on Mac) to search these terms. You don't need to read 8,000 words of legal prose. Just find the five terms and read the paragraphs around them.

Step 5: The clean VM test

This is the definitive test. It takes more work, but it eliminates all variables.

1. Set up a virtual machine. Use VirtualBox (free) or VMware Workstation Player (free for personal use). Install a fresh copy of Windows or macOS.
2. Install only your antivirus. Nothing else. Don't open a browser. Don't create documents. Don't install any other software.
3. Run a network monitor on the host machine (or inside the VM). Watch every outbound connection the antivirus makes.
4. Wait one hour. Don't touch anything. Let the antivirus just sit there on a clean system with nothing to scan and no user activity.

On a clean VM with no user activity, a privacy-respecting antivirus should make exactly one type of connection: virus signature updates. Maybe a license verification on first launch. That's it.

What to do if you catch something

If your testing reveals connections you're uncomfortable with:

1. Document everything. Screenshot the network monitor, save the DNS logs, note the domains and connection frequency. If you ever file a complaint, you'll want evidence.
2. Check for opt-out settings. Some vendors bury telemetry toggles in Advanced Settings or Privacy sections. Look for anything labeled "analytics," "usage data," "product improvement," or "experience enhancement." Turn all of them off.
3. Re-test after opting out. This is the important part. In my testing, opting out of telemetry reduced connections for some products but didn't eliminate them entirely. One product still made analytics connections after I disabled every telemetry setting I could find. If opt-out doesn't actually work, the only real solution is switching products.
4. File a complaint if warranted. In the EU, GDPR gives you the right to data access and deletion — file with your local data protection authority. In the U.S., submit a complaint at ReportFraud.ftc.gov. The FTC aggregates these complaints, and volume matters. That's part of how Avast eventually got caught.

A note on cloud-based detection

One thing worth saying clearly: cloud-based threat detection, where an antivirus sends a file hash (not the file itself) to a server for checking, is a legitimate technique. It can catch zero-day malware faster than local-only scanning because cloud databases update continuously.

The issue isn't cloud detection. The issue is when the connection goes beyond file hashes and extends to browsing data, device fingerprinting, application inventories, and advertising partnerships. There's a clear difference between "send this SHA-256 hash to check if it's malware" and "send every URL you visit to our servers for processing."

When you're evaluating your network monitor results, that's the line to watch for. Security connections to known malware databases are fine. Connections to analytics, advertising, and data aggregation companies are not.

What clean looks like

Full disclosure: XorShield is my product, so treat this as a testable claim rather than a trust request.

Here's what XorShield AV looks like in Little Snitch over a 48-hour monitoring period:

Process: XorShield
Connections: 12
All destinations: XorShield signature update server
Purpose: Signature database downloads
Average data per connection: ~280 KB
Total data transferred: ~3.4 MB

Twelve connections over 48 hours, all to the same server, all pulling virus definitions. Those signatures come from trusted, public threat-intelligence sources, refreshed regularly so your protection stays current.

No analytics. No telemetry. No ad networks. No mystery domains. Run the same test on your current antivirus and compare.

Last updated: April 2026