How to Turn Off Antivirus Data Collection (Every Major Brand)

You didn't install antivirus to be a data source. You installed it so you'd stop worrying about the files on your computer.

But most security suites ship with data sharing switched on, described in language that makes opting out sound faintly irresponsible — "help improve protection for everyone," "join the community." The settings are real and you can change them. They're just never on the first screen.

So here's where each one lives, in plain steps. Also here — because you should know before you spend the twenty minutes — is what these toggles don't cover, which several vendors state openly in their own documentation.

Before you start: what a toggle can't do

Two things are worth knowing up front, because they change what success looks like here.

Opting out of telemetry is not the same as opting out of everything. Norton's own support documentation, describing Norton Community Watch, states that critical data will still be sent even when the option is turned off. That's not a hidden practice — it's published, and other vendors carry similar caveats. A telemetry toggle reduces what's collected. It rarely reduces it to zero.

Some collection is genuinely functional. Signature updates require a connection. Licence validation requires an account check. Cloud lookups make certain detections work. The honest goal isn't zero packets — it's knowing which category each connection falls into, and shutting off the ones that exist for the vendor's benefit rather than yours.

Norton

The main setting is Norton Community Watch, which submits selected files and telemetry to Norton for analysis.

Windows: open Norton, then Settings → Administrative Settings. Find Norton Community Watch and switch it off. On older versions the path is Settings → General → Other Settings → Norton Community Watch.

Mac: open Norton, click Settings in the left pane, open the Privacy tab, and move the Norton Community Watch slider to off.

While you're in Administrative Settings, two more are worth turning off:

• Detailed Error Data Collection — sends diagnostic data about crashes and errors.
• Special Offer Notification — in-product marketing.

Then check the Norton Protection Report, the periodic summary Norton generates about your activity. If you'd rather not have it produced, look for the report or notification settings in the same area and disable it there.

The caveat, from Norton: their documentation notes that turning Community Watch off may affect submissions from some protection features, and that critical data is still sent. Take that at face value — it's their own published statement, and it's more transparent than most. For the full picture of what Norton's privacy notice covers, we went through it in what data does Norton collect.

Microsoft Defender

Defender is the one most people never touch, because it came with the machine and doesn't nag. It has two relevant settings, plus a Windows-level one that matters more than either.

In Windows Security: open Windows Security → Virus & threat protection → Manage settings. You'll find:

• Cloud-delivered protection — sends data to Microsoft's cloud for real-time threat lookups.
• Automatic sample submission — uploads suspicious files themselves for analysis.

If you prefer PowerShell, run as administrator:

Set-MpPreference -MAPSReporting 0 -SubmitSamplesConsent 2

Then the setting that covers far more than Defender — Windows diagnostic data: Settings → Privacy & security → Diagnostics & feedback. Turn off Send optional diagnostic data, and while you're there, Tailored experiences and View diagnostic data.

The caveat, from Microsoft: disabling sample submission also disables Block At First Sight, the feature that catches brand-new threats before a signature exists. That's a genuine detection reduction, not a scare tactic — Microsoft documents it plainly, and it's a real trade-off to weigh rather than dismiss.

Defender's deeper issue isn't any single toggle — it's that antivirus telemetry and operating-system telemetry are the same pipeline. We looked at what that means in is Windows Defender enough.

McAfee

In the app, open Settings → General Settings and Alerts and review the sections covering product improvement, analytics, and notifications. Turn off anything describing usage data, product improvement programs, or personalised offers.

The part worth knowing: according to McAfee's own privacy notice, the company shares certain information with third parties for interest-based advertising, and users who want to opt out of that must submit a separate Individual Data Request form on McAfee's website. It isn't available as a toggle inside the application.

That's the pattern to watch for generally. An in-app switch governs what the product sends. A web form governs what the company does with what it already has. They're different controls, and only one of them is where you'd think to look.

Avast and AVG

Both are Gen Digital products and share settings. Open Menu → Settings → General → Privacy, ("Data Preferences" in some builds), and turn off the options covering sharing data with third parties, sharing app usage data for product improvement, and personalised offers.

Also check Settings → General → Personal Privacy for any additional data-sharing controls, and review whether a browser extension was installed alongside the antivirus. Browser extensions have visibility into your browsing that the desktop app does not, and they're frequently installed as part of the default flow.

For context on why this one draws attention: in February 2024 the FTC announced an order requiring Avast to pay $16.5 million and prohibiting it from selling browsing data for advertising purposes, relating to data collected through its Jumpshot subsidiary. That's a matter of public record, and it's reasonable to let it inform how carefully you go through these particular settings.

Bitdefender

Open Settings → General and turn off Product Reports and Special Offers. Then check Privacy → Data Protection for any additional sharing controls in your version.

Bitdefender's consumer products are generally lighter on this than some competitors, but the settings still default to on, and the defaults are the point. Nothing here requires you to accept a default you didn't choose.

Verify it actually worked

Changing a setting and trusting the label is exactly the habit worth breaking. Watch the traffic instead — it takes a few minutes and it's the only method that doesn't rely on the vendor's description of their own behavior.

Windows: Resource Monitor (resmon) → Network tab shows per-process connections. TCPView from Sysinternals gives you more detail.

macOS: Little Snitch or LuLu will prompt on every outbound connection and show you which process opened it.

Linux:

sudo nethogs          # live per-process bandwidth
ss -tp                # active sockets with owning process
sudo tcpdump -i any -n host <vendor-domain>

What you're looking for: connections that continue after you've disabled telemetry, and whether their volume looks like signature updates or something larger. Periodic small transfers to an update domain are expected. Steady traffic to analytics or advertising domains is not.

Our full walkthrough — including how to read what you find — is in how to check if your antivirus is sending data home.

The trade-off nobody spells out

Here's the honest tension at the centre of all this, and it deserves stating rather than glossing.

Cloud-based detection genuinely works. When an antivirus uploads a suspicious file and gets an answer back in seconds, it catches things that local signatures would miss for hours. Vendors aren't inventing the security benefit to justify the data collection — the benefit is real.

The problem is that this architecture makes your files the raw material. Every "unknown" file on your machine becomes a candidate for upload, and you're trusting a company's retention policy, breach history, and future ownership with documents you never intended to share. Turning the setting off restores your privacy and costs you some detection speed. That's a real trade, and reasonable people land in different places on it.

What's worth questioning is why it has to be a trade at all.

That's the approach we took with XorShield AV. There's no telemetry setting to find, because there's no telemetry. No account, no email address collected, no cloud file uploads. The app makes one kind of outbound connection — signature updates — and you can confirm that with the same tools listed above, in about thirty seconds.

We'd rather you verify that than believe it. Run the check on us the same way you'd run it on anyone else. That's the standard we think every security vendor should be held to, including this one.

If you'd rather compare options first, we looked at which products collect nothing in the best antivirus with no data collection.

Go turn those settings off. Then go check.

Last updated: August 2026