Avast Free Antivirus

Avast Free Antivirus is a free antivirus for Windows, Mac, Android and iPhone from Avast, a company founded in Prague in 1988 and owned since 2022 by the US company Gen Digital. It runs inside the Avast One app; the paid Premium Security plan unlocks a firewall, email and text message scam protection and other extras in the same app.

Independent labs tested the free version in 2026 and gave it top or near-top results on Windows, Mac and Android. The weaker side is what the company has done with user data: from 2014 to 2020 browsing data collected by its software was sold to other companies, and in 2024 the US Federal Trade Commission ordered Avast to pay $16.5 million over it and the Czech data protection authority fined it.

Whether a free or a paid antivirus is needed at all depends on the system, because Windows, macOS, Android and iPhone each ship with their own protection; Do You Need an Antivirus? goes through them.

Lab Results

AV-TEST tested Avast Free Antivirus on Windows 11 in July and August 2026 and gave it the maximum 6.0 points for protection, speed and usability. It stopped 100% of 0-day attacks in both months, against an industry average of 99.9%, and raised no false warnings or false detections. The Windows version has scored 6.0 for protection in every round of 2026. On macOS, AV-TEST’s June 2026 round gave Avast One 6.0 in all three areas, and on Android its September 2026 round gave the phone app 6.0 in all three, catching every sample in both of its malware tests.

AV-Comparatives has tested Avast since 2004. In the September 2026 malware test on Windows, the free version blocked 9,996 of 10,000 samples, a 99.96% protection rate in the top group, with 15 false positives; it received the ADVANCED award, one step below the highest, in an award scheme that counts false alarms. In the real-world test from February to May 2026, which uses malicious websites and downloads, it blocked 397 of 400 attacks, a 99.3% protection rate, had 5 false positives against a test average of 8, and received the highest award, ADVANCED+.

The same lab’s 2026 Mac test found that the free Mac version blocked 99.9% of Mac malware and 95% of potentially unwanted Mac apps, with no false alarms, and its May 2026 Android review measured a 99.6% protection rate. Both reviews gave it the APPROVED award. No lab publishes results for the iPhone app.

What the Software Sends to Avast

Avast’s product privacy notice says the desktop app sends samples of suspicious files and details of each detection to Avast’s servers through a service called CommunityIQ, and that Avast may keep and analyse these files in its own environment. This is cloud scanning with whole files uploaded. The notice also lists the addresses of websites you visit, “malicious and non-malicious”, together with the referring page, and keeps them for 36 months for service provision. File-sample sharing can be switched off under Settings ▸ General ▸ Personal Privacy.

The phone apps send more for their scam features. SMS Guard collects text messages that contain links or come from senders who are not in your contacts; Avast removes personal identifiers and keeps them for up to five years. Call Guard, run with the company Hiya, records incoming numbers that are not in your contacts and the time and length of each call. Email Guard in Premium Security connects to up to five email accounts and downloads each message to scan it; Avast keeps suspicious messages only if you agree to it in the app.

Avast’s support pages say most of its apps share “anonymous data with Avast and other third parties” and that you can opt out. On Windows that means unticking the options for file samples and for app-usage analysis in third-party tools; usage data is collected until you do, which makes it telemetry you have to switch off yourself.

Account and Data Use

Gen Digital’s privacy notice says “We do not sell your personal data to third parties.” It also says the group uses data “to serve you with relevant advertising and content, both on our properties and on third-party properties” and may share personal data with advertising partners where the law allows. The free phone apps show third-party ads from networks such as Google’s AdMob, Amazon and Facebook Audience Network; Avast asks for consent at installation, and the paid version has no ads. The desktop app uses Google Analytics, and the phone apps use Google Firebase, AppsFlyer and Singular. In the free desktop version, sharing app-usage data so that Avast can show offers for its other products is on by default and cannot be switched off. This data use goes beyond protection.

For users in the European Economic Area, the company responsible for personal data is Avast Software s.r.o. in Prague, so EU data protection law applies. Avast’s parent, Gen Digital Inc., has its privacy team in Tempe, Arizona, and its notice says it may give data to public authorities and in legal proceedings.

Sale of Browsing Data

In January 2020 a joint investigation by Motherboard and PCMag reported that browsing data from Avast’s antivirus software was being sold through its subsidiary Jumpshot. On 30 January 2020 Avast’s chief executive, Ondrej Vlcek, wrote that the company would stop Jumpshot’s data collection and wind down the subsidiary “with immediate effect”. He wrote that Jumpshot had built its products from “the data feed coming from the Avast antivirus products” since 2015.

On 22 February 2024 the US Federal Trade Commission announced its case against Avast. According to its complaint, Avast collected browsing data through its antivirus software and browser extensions since at least 2014, stored it indefinitely, and through Jumpshot sold it to more than 100 companies, including advertising and data analytics firms, from 2014 to 2020. The data feeds included a unique identifier for each browser and could include every website visited with precise timestamps, and the user’s city and country; the FTC said Avast had falsely claimed it passed on only anonymous, aggregated data. The order, finalised in June 2024, required Avast to pay $16.5 million and banned it from selling or licensing browsing data from Avast products for advertising. Avast also had to delete the data and anything derived from it, tell affected users and run a privacy program. In December 2025 the FTC sent about $15.3 million to 103,152 Avast customers who had filed claims.

On 15 April 2024 the Czech data protection authority, ÚOOÚ, announced a final fine of CZK 351 million against Avast Software s.r.o. It found that during part of 2019 Avast passed the pseudonymised browsing histories of about 100 million users to Jumpshot, and that users had been wrongly told the data was anonymous. The case was handled together with other EU data protection authorities. These two decisions are the documented data sharing history of Avast. The current notices do not say that Avast sells browsing data; they describe the collection of visited website addresses for threat detection and sharing with advertising partners, as set out above.

Data Breach and Incident History

On 26 May 2014 Avast said its community-support forum, run on third-party software, had been hacked over the previous weekend: user nicknames, user names, email addresses and hashed passwords were compromised, affecting less than 0.2% of its 200 million users at the time. The company said no payment, licence or financial systems or other data were compromised, forced all forum users to set new passwords and moved the forum to a different software platform.

On 21 October 2019 Avast said attackers had entered its internal network. It noticed suspicious activity on 23 September 2019 and found that the attackers had apparently used compromised employee credentials through a temporary VPN profile that had been left enabled without two-factor authentication, with attempts going back to 14 May 2019. Avast believed the target was a supply chain attack on its CCleaner software. It stopped CCleaner releases, checked earlier ones and found no malicious changes, pushed a re-signed update on 15 October, revoked the old signing certificate and reset all employee credentials. The company’s account does not mention customer data. Of the two incidents, only the 2014 one exposed customer data. Together they are the data breach history on record for Avast.

Audits and Vulnerabilities

There is no published independent security audit of Avast’s consumer antivirus. Security researchers can report vulnerabilities through a form run by Gen Digital for all its brands, and the page says some reports can earn a reward, a form of bug bounty.

What Is Included

The free version includes real-time scanning of files and apps, behaviour monitoring, web protection against scam and malicious sites, ransomware protection, Wi-Fi network checks, alerts when a password linked to your email appears in a leak, and an AI assistant for checking suspicious messages. Premium Security adds a firewall, stronger ransomware protection, fake website detection, email and text message scam protection, a webcam shield, a shield against remote desktop attacks, a file shredder, automatic app updates and a sandbox for opening risky files, some of them on Windows only. A VPN and cleanup tools come only with the more expensive Ultimate plan, which makes it a bundled security suite.

Prices

The free version costs nothing and has no time limit. Premium Security costs $49.08 for the first year for one computer and one phone, then $77.99 a year, which the store names as the renewal price; for 10 devices it costs $69.48 for the first year and $99.99 a year after that. Ultimate, which adds the VPN and cleanup tools, renews at $139.99 a year for 10 devices. Subscriptions renew automatically at the then current price, and refunds are available within 30 days of a purchase or a renewal.

The free version is a full free tier for malware protection: it is the version the labs tested. It shows offers for Avast’s paid products, and on phones it also shows third-party ads.

Pros and Cons

Our Rating

Avast Free Antivirus suits people who want lab-tested malware protection on Windows, Mac or Android without paying. It does not suit anyone who weighs the company’s record with user data heavily, who does not want website addresses and suspicious files sent to the vendor, or who wants a free app without ads and offers.