Jumpshot’s Ill-Fated Journey From Grandma-Safe PC Protection Tool To Privacy Poison

The marketing industry loves to highlight case studies of success. But it’s possible to learn just as much if not more from failure. Marketing Fail is a new series from AdExchanger exploring the mistakes, missteps, gaffes and in some cases downright bad behavior of the marketing industry. This is the first installment.

What must’ve seemed like the perfect pivot in 2015 turned into a PR nightmare for cybersecurity firm Avast this week.

Avast said Thursday that it will wind down its marketing analytics unit, Jumpshot, effective immediately, following an unflattering joint investigation by Motherboard and PCMag into Jumpshot’s privacy practices. Hundreds of employees are set to lose their jobs.

Avast is also going to repay Cannes Lion parent company Ascential $60.8 million plus expenses for the 35% stake in Jumpshot that it sold to Ascential last July.

The Ascential investment had valued Jumpshot at roughly $177 million.

How did Jumpshot fall so low?

Jump fall

Jumpshot started life in 2010 as a PC cleanup tool founded by David Endler and Pedram Amini, two Tulane college buddies with consumer science degrees. Avast acquired their startup in 2013.

It was sometime between then and 2015 when Avast decided to start playing around with a new potential business line: collecting online consumer behavior data, including deidentified browsing history and past purchase information.

Jumpshot’s cleanup tools were rebranded, and the Jumpshot brand and site were transferred to a digital intelligence subsidiary within Avast in 2014. But the Jumpshot name lived on, and Avast decided to use it as the foundation for a new way to monetize.

Through its subsidiary, Avast would aggregate the data it gathered into a panel, package the information and sell it to brands who were more than happy to pay handsomely for anything that helped them map the customer journey.

Although the data was collected on an opt-in basis, the Motherboard and PCMag investigation found that most Avast users had no idea it was happening.

In 2015 both Endler and Amini left Avast within one month of each other.

Origin story

Endler and Amini founded Jumpshot idealistically, as a tool to automate the chores of typical PC maintenance and rid computers of spyware, adware, viruses and general bloat. Originally, the software came loaded on cute, cartoony USB memory sticks, which you can see on Jumpshot’s Kickstarter page from 2012.

Features included space optimization, browser speed optimization and, ironically, the ability to protect your identity and “[keep] your habits private from snooping.”

“We left our day jobs and created Jumpshot for a totally selfish reason – we were exhausted being PC tech consultants,” Endler joked in a press release when Jumpshot came out of stealth mode in 2012. “We truly wanted to build something that passed the Grandma test, a product we were proud to leave behind that wouldn’t impact the quality of our holiday gifts.”

When Avast acquired Jumpshot in September 2013, the stated rationale was to integrate Jumpshot’s PC performance technology with its own and make it available to Avast’s more than 400 million users by the end of that year.

Endler became Avast’s director of product, and Amini took on the director of software development role.

In 2014, tech executive Deren Baker was brought on as CEO of Jumpshot, and Avast launched GrimeFighter, a rebranded version of Jumpshot, which it rebranded yet again to Avast Cleanup the following year.

‘Jumpshot, a marketing analytics company’

And then, in 2015, Avast suddenly started referring to Jumpshot as a “marketing analytics company.” In a blog post from May 2015, just a few months before Jumpshot’s founders Endler and Amini were to exit the company, Avast board member Vince Steckler explained how Avast was starting to play around with using Jumpshot to collect consumer insights, such as product preference by state.

Steckler wrote that Avast wasn’t making any money off the data to start, but that it was “an experiment as to whether we can fund our security products indirectly instead of nagging our users to upgrade.”

Avast, he said, would provide Jumpshot with anonymized and aggregated data from scanning the 150 billion URLs its users visit each month. All the personally identifiable information would be stripped from the data before it left the Avast servers so that, according to Steckler, “nothing can be used to identify or target individuals.”

The transformation from PC performance improvement tool to marketing and analytics product was complete, and brands, including The Home Depot, Yelp, Pepsi, Microsoft and Google paid for this information.

As Jon Eenigenburg, an audience strategist on Intel’s data enablement and campaign measurement team, told AdExchanger in 2018, Intel worked with Jumpshot as a way to get around the fact that retailers don’t allow external tags or conversion pixels on their sites.

At the time, Intel was placing the Jumpshot pixel on its ads so it could see the browsing history and shopping behavior before and after exposure to Intel campaigns compared to a control group across Intel’s full network of online retail partners.

“In order to really know your customer, you need to know what they’re doing when they’re not on your website, aka, the other 99.9% of the time,” Baker, Jumpshot’s CEO, told AdExchanger in reference to the company’s work with Intel.

It seems clear, though, that consumers were not properly informed of how their online behavior was being tracked.

Privacy is sort of a policy

Both Jumpshot’s and Avast’s respective privacy policies are dense and vague at best.

Jumpshot states that it gathers aggregated data about users, that it discloses the results to partners, service providers, advertisers and other third parties for marketing purposes and that some of this data comes through its affiliation with Avast.

Avast says in its privacy policy that “we have partnered with our subsidiary, Jumpshot, Inc., that uses stripped and de-identified data to build products and services that provide trend analytics for companies.”

But you’ve got to click on a separate consent policy for any level of detail on what is actually being collected.

The consent policy explains that when using its free antivirus products for desktop or Android, Avast gathers clickstream data, product version, approximate location, time information, browser type and cookies.

Although Avast claims this information is fully de-identified, the Motherboard/PCMag investigation found that it was possible to link some data back to a person’s identity, including their searches and site visits.

“We started Jumpshot in 2015 with the idea of extending our data analytics capabilities beyond core security; this was during a period where it was becoming increasingly apparent that cybersecurity was going to be about big data,” wrote Avast CEO Ondrej Vlcek in an apology blog post. “We thought we could leverage our tools and resources to do this more securely than the countless other companies that were collecting data.”

Apparently not.

Updated Jan. 31 with more detail on the GrimeFighter rebrand.

Enjoying this content?

Sign up to be an AdExchanger Member today and get unlimited access to articles like this, plus proprietary data and research, conference discounts, on-demand access to event content, and more!

Join Today!