What Data Does Norton Collect? A Privacy Policy Breakdown

Norton collects your device fingerprint, browsing activity, file metadata, network connection data, and location information. That's not an accusation — it's what their own privacy notice says. I spent a weekend reading the full thing so you don't have to.

Here's every category of data, where it goes, and why it matters that Gen Digital — the company behind Norton — also owns Avast, AVG, Avira, and LifeLock.

Who actually owns Norton?

Norton isn't a standalone company. It's a brand under Gen Digital Inc. (NASDAQ: GEN), formerly NortonLifeLock, formerly Symantec Consumer. Gen Digital completed its acquisition of Avast in September 2022 for roughly $8.6 billion.

That means Gen Digital now controls:

• Norton
• Avast
• AVG
• Avira
• LifeLock
• CCleaner

One company. Six security brands. About 500 million users combined. Gen Digital reported $3.94 billion in revenue for fiscal year 2025 — up from $3.8 billion the year before. That's a staggering amount of device data flowing to a single entity. And Avast — now part of the same corporate family — was fined $16.5 million by the FTC in February 2024 for selling browsing data through its Jumpshot subsidiary.

Keep that context in mind as we go through Norton's data practices.

What Norton's privacy notice actually says

I'm pulling directly from the Gen Digital Privacy Notice, last updated in 2024. It covers all Gen brands, Norton included. The notice breaks collection into categories. Let me walk through each one.

Device and hardware information

Norton collects your operating system version, hardware identifiers, device settings, browser type, installed applications (yes, plural — the full list), file names, and SHA-256 hashes of files on your system.

"Device internal identifiers (UDID, IMEI, MAC address), device and hardware settings, operating system, operating system configuration, installed applications and application versions."

That's a direct quote. Your MAC address is a hardware-level identifier unique to your network card. Your IMEI uniquely identifies your phone on every cellular network on Earth. These aren't analytics — they're fingerprints.

Network and connection data

Norton logs your IP address (which maps to your approximate location), your ISP name, connection speed, connection type, and nearby Wi-Fi networks. The privacy notice lists this under "security telemetry," but the granularity goes well beyond what's needed to detect malware.

Nearby Wi-Fi networks. Think about what that means. Your antivirus is cataloging the wireless networks in your physical vicinity — data that, combined with public Wi-Fi mapping databases, can pinpoint your location to within about 15 meters.

Browsing and online activity

If you use Norton's browser extensions — Norton Safe Web, Norton Safe Search, or the Norton Password Manager extension — they collect URLs you visit, search terms, and browsing timestamps.

The privacy notice phrases it as "URLs and referral URLs" and "search terms." Norton Safe Search replaces your default search engine with a Norton-branded search experience. Every query you type goes through their infrastructure first.

Even without the browser extension, Norton's firewall component logs connection metadata — which domains your machine connects to, when, and how often.

File metadata and scan results

When Norton scans your files, it doesn't just check for malware locally. The privacy notice discloses that file metadata — including file names, sizes, hashes, and detection results — may be transmitted to Norton's cloud infrastructure for "threat analysis."

This is the part most people miss. Your antivirus sees every file on your computer. It knows what documents you have, what applications you've downloaded, what media you store locally. And it's sending metadata about those files to a server.

The NortonCrypto incident

In January 2022, Norton rolled out Norton Crypto — a cryptocurrency miner built directly into Norton 360. It mined Ethereum using your computer's GPU.

Norton took a 15% cut of everything mined. Mining pools typically charge 1-2%.

Users didn't ask for this. It appeared as a feature toggle in Norton 360, and some users reported it was enabled by default or pre-checked during installation. The mined Ethereum went to a Norton Crypto wallet, and withdrawing it required paying gas fees — which at the time ran $50-100 per transaction, often eating the profits entirely.

When security researchers questioned why an antivirus company was installing a crypto miner — something that most antivirus software, including Norton itself, would flag as a Potentially Unwanted Program (PUP) — Norton's response was that it was "optional."

Norton quietly discontinued the feature in 2023 after sustained criticism. But the fact that it shipped at all tells you something about how Norton views its relationship with your hardware. Your CPU cycles, your electricity, your GPU — Norton saw those as resources it could monetize.

The 2023 credential-stuffing attack

In January 2023, Gen Digital disclosed that approximately 925,000 Norton LifeLock accounts were targeted in a credential-stuffing attack. Attackers used username/password combinations leaked from other breaches to log into Norton accounts.

Successful logins exposed the data stored in Norton Password Manager vaults — including site credentials, form-fill data, and secure notes. Gen Digital notified affected users and forced password resets.

This wasn't a Norton vulnerability per se — credential stuffing exploits password reuse. But it raises a question: should your antivirus company be storing your passwords in the first place? Every additional service bolted onto a security product is another attack surface. Norton isn't just an antivirus anymore. It's an antivirus, a VPN, a password manager, a crypto wallet, an identity theft monitor, and a dark web scanner. Each of those services creates data. Each one is a target.

Third-party sharing

Gen Digital's privacy notice includes the standard language about sharing data with "service providers" and "business partners." But there's a more specific disclosure buried in the notice:

"We may share your information with advertising networks and analytics providers."

That's advertising networks. Not "security partners." Not "threat intelligence feeds." Advertising networks.

The notice also discloses that Gen Digital participates in "cross-context behavioral advertising" — meaning data from your Norton usage can inform ads you see elsewhere. If you're running Norton and seeing weirdly specific ads afterward, this is probably why.

Gen Digital reported $3.94 billion in revenue for fiscal year 2025. The vast majority comes from subscriptions, but the company has consistently invested in data monetization infrastructure. Remember: this is the same company that bought Avast — whose entire Jumpshot subsidiary existed to sell user browsing data.

What Norton doesn't make easy

Opting out of data collection in Norton isn't a single toggle. There's no master "don't collect my data" switch.

You need to:

1. Open Norton settings and disable "Norton Community Watch" (their telemetry program).
2. Separately disable Norton Safe Web and Norton Safe Search browser extensions.
3. Visit Gen Digital's privacy preference center website to opt out of interest-based advertising.
4. If you're in California or the EU, submit a separate data deletion request through their online form.

Each of these is a different interface, in a different location, requiring different steps. The default for all of them is opted in.

Norton Community Watch

This is Norton's telemetry program. When enabled — and it's enabled by default — it sends "security data" from your computer to Norton's servers. Norton describes it as helping improve threat detection. In practice, it means your scan results, file metadata, and application behavior data are being uploaded continuously.

Norton's own support page says Community Watch collects "information about potential security risks" from your computer. That's deliberately vague. "Potential security risks" could mean any file, any process, any network connection.

The real question: is this normal?

Here's where I want to be fair. Some data collection is standard in the antivirus industry. Cloud-based threat detection — where a file hash is checked against a server-side database — is a legitimate approach that catches new malware faster than local-only scanning.

The issue with Norton isn't that it collects data. It's the scope.

Device fingerprinting (MAC address, IMEI). Nearby Wi-Fi networks. Browsing activity through extensions. Full installed application lists. File names. Advertising network partnerships. A crypto miner. A password manager that became a credential-stuffing target.

Norton is a product that asks for the deepest level of system access — kernel-level, root-level, sees-everything access — and then uses that position to collect data far beyond what malware detection requires.

What you can do

If you're currently running Norton and want to limit exposure:

• Disable Norton Community Watch in Settings → Administrative Settings.
• Remove all Norton browser extensions. Norton Safe Web and Norton Safe Search are the biggest data collectors.
• Don't use Norton Password Manager. Use a dedicated, audited password manager like Bitwarden (open source) or 1Password instead.
• Visit Gen Digital's privacy center and opt out of interest-based advertising.
• Consider alternatives. If privacy matters to you, there are antivirus options that don't collect browsing data or partner with ad networks. See how the trade-offs compare in our XorShield vs Norton breakdown.

Norton still detects malware effectively. AV-TEST gives it consistent top scores. But malware detection and privacy are two different things, and Norton's business model treats your data as a revenue source alongside your subscription fee.

You're paying $99.99/year for Norton 360 Deluxe. And they're still collecting your data for advertising. At that price, you'd think the product would be the product — not you.

Last updated: May 2026. Sources: Gen Digital Privacy Notice (2024), Gen Digital FY2025 Annual Report, FTC Avast settlement (Feb 2024), Norton support documentation.