AVG AntiVirus Free

AVG AntiVirus Free is a free antivirus for Windows, Mac, Android and iPhone from AVG, a company that says it has made security software since 1991 and that has belonged to the US company Gen Digital since 2022. The paid plans, Internet Security and Ultimate, add protection against fake and phishing websites and Wi-Fi checks; Ultimate also includes a VPN, a PC cleanup tool and a tracker blocker.

Independent labs tested AVG’s antivirus in 2026, the free version in most of the tests, and gave it top or near-top results on Windows, Mac and Android. The weaker side is AVG’s record with user data. A company of the same group sold browsing data from 2014 to 2020, and an AVG browser extension was among the sources; the US Federal Trade Commission ordered it to stop such sales in 2024. In 2023 some AVG customer information, such as names, email addresses and phone numbers, was affected in an incident at the MOVEit file-transfer software, which AVG confirmed in a reply in its own community forum.

Whether a free or a paid antivirus is needed at all depends on the system, because Windows, macOS, Android and iPhone each ship with their own protection; Do You Need an Antivirus? goes through them.

Lab Results

AV-TEST tested AVG AntiVirus Free on Windows 11 in July and August 2026 and gave it the maximum 6.0 points for protection, speed and usability. It stopped 100% of 0-day attacks in both months, against an industry average of 99.9%, and raised no false warnings or false detections. In the four rounds of 2026 so far (February, April, June and August) the free version got 6.0 for protection and 6.0 for usability every time; performance was 5.5 in February and 6.0 in the other three. On macOS, AV-TEST’s June 2026 round gave AVG AntiVirus 6.0 in all three areas, and on Android its September 2026 round gave the free phone app 6.0 in all three, with every sample caught in both malware tests.

AV-Comparatives’ malware test of September 2026 on Windows had the free version block 9,996 of 10,000 samples, a 99.96% protection rate in the top group, with 15 false positives; it received the ADVANCED award, one step below the highest, in an award scheme that counts false alarms. In the real-world test from February to May 2026, which uses malicious websites and downloads, it blocked 397 of 400 attacks, a 99.3% protection rate, had 5 false positives against a test average of 8, and received the highest award, ADVANCED+. The same lab’s performance test of September 2026 put its impact on computer speed sixth lowest of 20 products, also with ADVANCED+.

AV-Comparatives’ 2026 Mac test found that the free Mac version blocked 99.9% of Mac malware and 95% of potentially unwanted Mac apps, and its May 2026 Android review measured a 99.6% protection rate with 2 false positives among 500 clean apps. Both reviews gave it the APPROVED award. The lab’s reports say AVG’s detection engine is also used in other products, which is why those products show identical scores in the same tests. The mobile tests are for Android only, so the iPhone app has no independent lab testing.

What the Software Sends to AVG

AVG’s product privacy notice says the desktop app, which includes AVG AntiVirus Free, sends samples of suspicious files and details of each detection to AVG’s servers through a service called CommunityIQ, and that AVG may analyse suspicious files in its own environment. This is cloud scanning with whole files uploaded. The notice also lists the URLs of pages and the referring page, which for malicious addresses may include search terms or cookie information, kept for 36 months, along with your IP address, the applications and other security software installed on the computer, and product usage events. The support article on privacy settings lets you untick two options in Preferences: sharing threat data and sharing app-usage data.

The Android app sends the addresses of websites visited, “malicious and non-malicious”, for 36 months, and its scam features collect more. SMS Guard keeps text messages that contain links or come from senders who are not in your contacts, with personal identifiers removed, for up to five years. Call Guard, run with the company Hiya, records the number, line type and country of incoming calls from people who are not in your contacts and the time and length of each call; the number is removed after 30 days and the rest kept for 36 months. The email-scanning feature, Email Guard, which the notice lists for the desktop and Android apps, downloads each message from a connected email account to scan it and stores suspicious messages unless you opt out, for 30 days as received and 60 months in de-identified form; AVG’s human reviewers may read messages to check a detection.

AVG’s support article says that when you use most AVG apps you share anonymous data with AVG and other third parties, and that you can opt out at any time. The sharing is therefore telemetry you have to switch off yourself.

Account and Data Use

Under Gen Digital’s group privacy notice, data use reaches advertising. The notice says “We do not sell your personal data to third parties” and also that, where the law allows, the group may share personal data with third parties for advertising. The free Android app shows third-party ads from networks such as Google’s AdMob, Amazon, Facebook Audience Network, InMobi, AppLovin, Unity, IronSource and Liftoff; AVG asks for consent at installation, passes the advertising ID to IronSource, and sells an equivalent version without ads. The desktop app uses Google Analytics, and the phone apps use Google Firebase, AppsFlyer and Singular. In the free version, the setting that lets AVG show offers for its other products based on app usage cannot be switched off.

For users in the European Economic Area, the company responsible for personal data is a Czech company in Prague, so EU data protection law applies. The parent, Gen Digital Inc., has its privacy team in Tempe, Arizona, and its notice says it may give data to public authorities and in legal proceedings.

Sale of Browsing Data

In February 2024 the US Federal Trade Commission announced a case against a company of the same group, its Czech subsidiary and a data subsidiary, Jumpshot. According to the complaint, the group company collected browsing information through browser extensions and antivirus software from 2014, stored it indefinitely, and sold it through Jumpshot to more than 100 customers; the FTC said it had claimed it would pass on only anonymous, aggregated data. The data feeds included a unique identifier for each browser and could include every website visited with precise timestamps, and the user’s city and country.

AVG appears in the case in two places. The complaint names two browser extensions that collected browsing activity, one of them AVG Online Security, which collected the addresses of pages visited, search queries and cookie values; it describes both as protecting privacy, and groups the data from all the products together without saying how much came from this one. The antivirus programs the complaint names are not AVG-branded, so the case does not say that AVG AntiVirus collected or sold browsing data. The order that the FTC finalised on 26 June 2024 lists AVG Online Security among the products covered by its notice rules and required a notice on avg.com for 180 days; the model notice says people who used AVG software, among others, between August 2014 and January 2020 may have been deceived.

The order bans the group company from selling, disclosing or licensing browsing data for advertising purposes and required it to pay $16.5 million, delete the data transferred to Jumpshot and anything derived from it, notify affected users and run a privacy program. On 30 January 2020 the group company’s chief executive had announced that Jumpshot’s data collection would end and the subsidiary would be wound down “with immediate effect”.

On 15 April 2024 the Czech data protection authority announced a final fine of CZK 351 million against the Czech subsidiary, named in AVG’s Privacy Center as the controller of AVG products in Europe. It concerned pseudonymised browsing histories of about 100 million users of the group company’s antivirus program and browser extensions in part of 2019; the announcement does not name AVG. These cases are the documented data sharing history of the group AVG belongs to, and the part that reaches AVG itself is the browser extension. The current notices do not say that browsing data is sold; they describe the collection of URLs and referrers (all visited sites on Android) and the sharing with advertising partners set out above.

MOVEit Data Breach

On 27 October 2023 an account answering for AVG replied to customers’ questions in AVG’s community forum about an email they had received. The reply confirmed that the email was genuine and that, “as part of the MOVEit incident, some customer information, such as name, email address and phone number, was impacted”. MOVEit is a file-transfer program from Progress Software, and the reply links to a Progress Software advisory. AVG wrote that its systems were secure and operational and that the cause was addressed when the incident was discovered; it called the information “not considered high risk” and advised customers to watch for phishing messages that use it. AVG’s forum reply does not say how many customers were affected. This is the data breach history on record for AVG.

Audits and Vulnerabilities

There is no published independent security audit of AVG’s consumer antivirus. Security researchers can report vulnerabilities through a form run by Gen Digital for all its brands; the page says not all submissions may be eligible for a reward, a form of bug bounty, and names no scope or amounts.

What Is Included

AVG’s own pages disagree on how much the free version covers. The download page lists Wi-Fi protection, safer browsing and emailing, ransomware protection and alerts when an email password leaks among its free features, while the store’s comparison table marks Wi-Fi network checks, fake-website protection and phishing protection as Internet Security only; both agree on real-time malware and ransomware protection. According to its product page, Internet Security adds an advanced firewall, a shield against apps using the webcam and a file shredder. A VPN, a PC cleanup tool and a tracker blocker come only with the more expensive Ultimate plan, which makes it a bundled security suite.

Prices

The free version costs nothing. Internet Security costs $39.99 for the first year for one Windows PC, then $79.99 a year; for 10 devices it costs $59.88 for the first year on the store page, then $109.99 a year. Ultimate, which adds the VPN, cleanup and tracker tools, renews at $149.99 a year for 10 devices after a first year at $59.88. Subscriptions renew automatically at the then current price, with a reminder 65 days before the renewal, and the product page offers a 30-day money-back guarantee.

The free version is a free tier with fewer protection features than the paid plans, and both labs name it in their Windows and Android tests. It shows offers for AVG’s paid products, and on Android it also shows third-party ads.

Pros and Cons

Our Rating

AVG AntiVirus Free suits people who want lab-tested malware protection on Windows, Mac or Android without paying. It does not suit anyone who weighs the group’s record with user data heavily, who does not want suspicious files and URLs linked to detections sent to the vendor, or who wants a free app without ads and offers.