If You Have an Antivirus, You're Probably in Breach of GDPR

First in a series on software, truth, and the stories we're told.

---

Here's a thought experiment: name one piece of software on your computer that has unrestricted root access to every single file, scans everything you open, monitors every URL you visit, and phones home with the results. You're thinking of malware. I'm describing your antivirus.

The Architecture of Total Surveillance

Antivirus software operates on a simple premise that's also a privacy nightmare: to protect you from malicious files, it must inspect all files. Every document. Every spreadsheet. Every photo. Every email attachment. Every browser cache entry. Every password manager database. Every encrypted volume mounted at the time of scanning.

This isn't a bug — it's the fundamental design requirement of the product category. Your AV sits between you and your filesystem with higher privileges than you have. On Windows, it runs as SYSTEM. On macOS, it hooks into the kernel via system extensions. On Linux, it often demands root.

The GDPR defines personal data as any information relating to an identified or identifiable natural person. Your antivirus isn't casually glancing at metadata — it's deep-inspecting file contents, process memory, network traffic, and browser activity. That's not just personal data. That's the entirety of your digital life.

What They Actually Collect

Most users assume their AV just compares file hashes against a local malware database. That's adorable. The reality is far more invasive. Here's what modern antivirus products routinely exfiltrate (and this is just what's documented):

• Browsing history — full URLs visited, including query parameters, timestamps, and referrer chains. This reveals your political views, health concerns, sexual orientation, religious beliefs, and financial status. The FTC complaint against Avast confirmed they collected all of this and sold it.¹
• Device fingerprint — hardware IDs, installed applications, OS version, network topology, number of devices on your LAN, default browser, and unique advertising identifiers.
• File metadata and samples — suspicious files get uploaded in their entirety to cloud analysis sandboxes. That "suspicious" PDF your accountant sent? Uploaded. The Word doc with your medical records? Uploaded. The .pst file with ten years of email? You get the idea.
• Location data — IP address, WiFi network names, sometimes GPS coordinates from mobile AV products.
• Email content — several AV products scan email bodies and attachments, and some upload flagged messages for analysis.
• Process behavior — which programs you run, when you run them, how long they're active, what files they touch.

Where Does This Data Go?

The short answer: everywhere you don't want it to go.

Avast, through its subsidiary Jumpshot, sold browsing data from roughly 100 million users to over 100 third parties between 2014 and 2020 — including consulting firms, investment companies, advertising networks, marketing analytics firms, and data brokers. The data was sold in non-aggregate, re-identifiable form with unique per-browser identifiers. Clients could track individual users across sessions and correlate their browsing with other datasets.^{1 2}

Kaspersky automatically uploads suspicious files to its cloud infrastructure. Their privacy policy admits they process "the object (file or URL) itself." Where do those servers live? Russia, Switzerland, and other jurisdictions — the data transfer agreements are opaque at best.³

McAfee, Norton, Bitdefender, ESET — they all have cloud-based threat analysis. They all upload file samples. They all collect telemetry. The specific data flows are buried in privacy policies that would take a lawyer three billable hours to parse, and even then, the policies use weasel words like "may include" and "such as" that give them infinite latitude.⁴

Here's the kicker: under GDPR Articles 44-49, transferring personal data outside the EU requires either an adequacy decision, appropriate safeguards, or explicit consent.⁵ When your AV uploads a file containing personal data to a cloud server in a non-adequate jurisdiction — which most of them do — and you didn't explicitly consent to that specific transfer, you've got a GDPR violation. The Czech decision explicitly found that the "anonymization" claims were false and that the data remained personal data throughout.⁶

The Architecture of Trust: Why "Trust Me" Is Not a Security Posture

There's a deeper pattern here, and it's not unique to Avast. Every commercial antivirus vendor asks you to do something that no security professional would accept in any other context: grant unrestricted access to an entity you cannot audit, on the promise that it means you no harm.

This is not a security decision. It's a theological one. You are being asked to have faith — faith in the vendor's good intentions, faith in their engineering competence, faith in their resistance to government pressure, faith in their immunity to compromise. And faith, whatever else it may be, is not a control under ISO 27001.

Consider something utterly mundane: a yogurt. When you buy a yogurt, you flip the container and read the ingredients. Not the recipe — the manufacturer doesn't disclose their proprietary fermentation process. But they do disclose what's in the product. And you accept that list as truthful not because you trust the manufacturer, but because independent regulatory authorities exist to verify those claims and sanction non-compliance.

Now, that system isn't perfect. Regulatory capture is real. Agencies can be underfunded, understaffed, or outright corrupted. But the principle is sound: verification by an independent third party with enforcement powers creates a structural incentive for honesty that no amount of corporate promises can replicate.

Closed-source antivirus offers you none of this. You cannot flip the container. There is no ingredients list — only a privacy policy written in weasel words by lawyers whose job is to maximize legal latitude, not to inform you. There is no independent regulatory authority that audits what data your AV actually collects versus what it claims to collect. The Czech DPA fined Avast €13.9 million — but only after a whistleblower exposed the practice, only after years of data sales had already occurred, and only for one vendor among dozens.

And even that fine addresses the past. It does nothing to verify what the software is doing right now, on your machine, after the latest automatic update. The regulatory apparatus is reactive, forensic, and years behind the technology it purports to oversee. In the time it takes to investigate one vendor, a hundred others have updated their telemetry clients, modified their data flows, and rewritten their privacy policies.

The GDPR doesn't use the word "trust." It uses the word "demonstrate" — Article 5(2), the accountability principle, places the burden of proof squarely on the controller. You must be able to show that processing is compliant, not merely believe it. And you cannot demonstrate what you cannot verify.

This is the philosophical fault line that runs through all four articles in this series. Privacy is not a promise. It is a property of what software actually does, not what it claims to do. And the only way to know what software actually does is to inspect it — through source code access, through reproducible builds, through architectures that make data flows transparent rather than opaque.

Closed-source antivirus inverts this entirely. It takes the one piece of software with the highest privileges on your system and makes it the one piece of software you can least inspect. There is no ingredients list. There is no regulatory authority with real-time auditing powers. There is only the vendor's word — and the vendor's word, as Avast demonstrated, is worth exactly what you paid for it.

This is not a bad implementation of a good idea. It is a category error — like asking a burglar to install your locks because he knows the most about breaking them. The next article will prove that this is not merely a practical problem but a logical one: "privacy-respecting closed source software" is a contradiction in terms, a square circle. But its root is here: in the moment you realize that the entity protecting you from malware is architecturally indistinguishable from the malware it claims to protect you from, and that you have no way to tell the difference except the vendor's word — in an industry where that word has already been broken, at scale, for profit.

The Legal Contradiction

If you're a business operating in the EU, you're required under GDPR to implement "appropriate technical and organisational measures" to protect personal data. Article 5(1)(f) mandates integrity and confidentiality. Article 32 requires encryption and resilience.

Now install an antivirus. You've just deployed software that:

1. Has root-level access to all personal data you process
2. Exfiltrates file contents and metadata to third-party servers
3. Operates in jurisdictions with inadequate data protection
4. Provides no data processing agreement that satisfies Article 28
5. Cannot guarantee data deletion or purpose limitation

If a data subject files a Subject Access Request asking what data your AV vendor holds on them, what do you tell them? You don't know. The vendor won't tell you. And you're the data controller — you're liable.

You cannot simultaneously comply with GDPR and operate a cloud-connected antivirus on systems processing personal data. Choose one.

The Root Access Problem

Let's address the elephant in the room. Your antivirus has higher privileges than you do on your own machine. It can:

• Read any file, regardless of permissions
• Modify any file, including system files
• Intercept and modify network traffic (HTTPS inspection/MITM)
• Inject code into running processes
• Install kernel drivers that operate below the OS visibility layer
• Disable or bypass other security controls

The Planting Problem: When Your Protector Becomes Your Accuser

Let's go further. The discussion so far has assumed the threat model is extraction — your antivirus takes data from you and sends it elsewhere. But a system with unrestricted root access and a persistent encrypted connection to remote servers is capable of something far more sinister: injection.

A few strategically-named files placed in the right directories. A modified browser history entry pointing to something you never visited. A "detected threat" that was never actually on your machine — planted by the very software that then "discovers" it and reports it to the cloud console. And suddenly you are not the victim of a security incident. You are the perpetrator.

This is not a hypothetical. When Julian Assange was arrested at the Ecuadorian embassy in London in April 2019, WikiLeaks editor-in-chief Kristinn Hrafnsson stated publicly that Assange had scrubbed his computers and hard drives before his arrest — precisely because he anticipated that any data subsequently found on them would have been planted. "If anything surfaces, I can assure you it would've been planted," Hrafnsson told the Associated Press. Ecuadorian authorities, at the request of the U.S. government, took possession of all of Assange's equipment. The machines were out of his control. The chain of custody was broken. Whatever was subsequently "found" on those devices was, by definition, unverifiable.⁷

The case of Dr. Reiner Fuellmich — the German lawyer who led the Corona Committee investigating government COVID responses, subsequently prosecuted, extradited from Mexico, and convicted in a trial where his defense documented systematic procedural violations and where co-workers later admitted in writing to having given false testimony — illustrates the same pattern through the legal rather than the digital channel. The mechanism differs. The principle is identical: when you become inconvenient to institutional power, the apparatus that claims to protect you can be redeployed to destroy you.⁸

The Illusion of the Radar

At this point, a reasonable reader might think: this is disturbing, but it doesn't apply to me. I'm not Julian Assange. I'm not Reiner Fuellmich. I'm not a journalist, a dissident, a whistleblower. I keep my head down. I'm not on anyone's radar.

This is a comforting thought. It is also demonstrably false — and the COVID era proved it at unprecedented scale.

Between 2020 and 2022, hundreds of thousands of ordinary people — doctors, nurses, teachers, parents, small business owners, and private citizens with no public profile whatsoever — had their social media accounts suspended, their posts labeled as "misinformation," their videos removed, and their professional reputations damaged. Not because they were spies or hackers or dissidents. Because they questioned vaccine mandates. Because they shared early-treatment data. Because they posted a link to a study that contradicted the institutional narrative.

This was not fringe content from shadowy figures. It included Nobel laureates and tenured professors. The French virologist Dr. Didier Raoult, one of the most cited infectious disease researchers in the world, saw his early-treatment research attacked and his institution investigated after he published positive results for hydroxychloroquine.⁹ Dr. Luc Montagnier, who won the Nobel Prize for co-discovering HIV, was deplatformed and ridiculed for questioning vaccine safety.¹⁰ If a Nobel laureate isn't safe from the machinery of institutional censorship, you aren't either.

And the consequences were not abstract. People lost jobs. Parents lost custody battles because their "misinformation" social media history was submitted as evidence of unfitness. Doctors lost their licenses for prescribing treatments that later proved effective. The digital trail left by platforms, security software, and cloud services became a weapon — not against criminals, but against anyone who deviated from the approved narrative.

The point is not to relitigate COVID policy. The point is that the infrastructure of surveillance and control — the same infrastructure that includes your antivirus, your cloud storage, your social media accounts, your browser history — was deployed against ordinary people, at scale, for the crime of holding the wrong opinion at the wrong time. And the determination of what constituted the "wrong" opinion changed month to month, based on shifting institutional consensus rather than scientific evidence.

Today's heterodoxy is tomorrow's orthodoxy — the CDC, under the MAHA initiative, has now revised its position on the vaccine-autism question, acknowledging that the claim "vaccines do not cause autism" is not evidence-based. The views that got people deplatformed in 2021 are now, in some cases, official government positions.¹¹ But the people whose lives were destroyed in the interim don't get a refund on their reputations.

The AV you installed to protect you from malware is part of this infrastructure. It has root access to the files that could be used to discredit you. It operates on an update channel that could be compromised. And the threshold for becoming a target is not "committed a crime" or "threatened national security." As the COVID era demonstrated, the threshold can be as low as "shared a study the algorithm didn't like."

The Stuxnet operation proved that security software update channels are a viable attack vector for deploying payloads to millions of machines. If an intelligence agency can compromise an AV vendor's update infrastructure, they can deploy anything to anyone, instantly, with the full trust of the operating system and the user. And the COVID era proved that the definition of "anyone" is not limited to spies and terrorists. It includes you.

This is not an argument that your AV vendor is planting evidence on your machine. It is an argument that the architecture makes it possible, that history provides examples of powerful entities doing exactly this kind of thing through exactly these kinds of channels, that the COVID era demonstrated the machinery of digital control being deployed against ordinary citizens at mass scale, and that you have no way to verify that it isn't happening to you. In security terms, this is an unacceptable residual risk — a threat vector that cannot be mitigated, only accepted. And accepting it means accepting that the entity you trusted to protect you has the capability to destroy you, and you would never know until it was too late.

The Alternative: Security Through Architecture, Not Through Rootkits

If cloud-connected antivirus is both a privacy violation and a security liability, what replaces it? The answer is not another product. It's a different approach to security entirely — one based on architectural discipline rather than trusted third parties.

Minimal attack surface. Every installed package is a liability. Every background service is a potential entry point. Every line of code you're not running is a line of code that cannot be exploited. The GDPR-compliant security posture begins with a simple question: what can I remove? A base system that runs only what is strictly necessary — no telemetry daemons, no cloud sync agents, no pre-installed bloatware — eliminates entire categories of vulnerability before any protective measure is applied. This is not paranoia. It's Article 25 (data protection by design) made operational: you cannot exploit what isn't there.

Compartmentalization. The principle is simple in concept and powerful in execution: if one component is compromised, it must not be able to reach anything else. Your browser — the most exposed piece of software on any system — should not have access to your documents. Your email client should not have access to your browser's cookie store. Your PDF viewer should not have access to your SSH keys. On conventional operating systems, all of these run with the same user privileges and can read each other's data freely. Compartmentalization breaks this assumption by running risky applications in isolated contexts — separate Unix users, restricted filesystem views, or, for high-security scenarios, separate virtual machines. The compromise of one component becomes a contained incident, not a catastrophic breach.

Read-only wherever possible. An immutable base system — one where the core operating system files cannot be modified, even by root — eliminates persistence mechanisms for malware. Separate data partitions mounted with noexec prevent downloaded files from becoming running processes. These are not exotic configurations; they are standard Unix features that have existed for decades and been systematically hidden from users by operating systems that prioritize convenience over security.

Network-level filtering. Blocking known malicious infrastructure should happen at the network boundary — the router, the firewall, the DNS resolver — not on the endpoint. A compromised endpoint security product becomes the threat; a compromised router cannot read your files. DNS-level filtering (like a local Pi-hole or Unbound configuration) blocks malware command-and-control domains before any device on the network ever connects to them, without requiring root access to any endpoint.

Application-level firewalls. Instead of trusting a rootkit to "manage" which applications can phone home, the system itself enforces the rules. On OpenBSD, PF (Packet Filter) can restrict outbound connections by user ID, meaning the browser user can reach the internet but the document-processing user cannot. This is not a product you buy. It's a configuration you write, once, and it doesn't change unless you change it. No vendor can push an update that silently modifies your firewall rules.

None of this requires closed-source kernel modules. None of it requires trusting a corporation whose business model depends on harvesting your data. None of it requires faith. It requires understanding your system — which is precisely the skill that two decades of "it just works" computing have systematically extracted from users. But that is a topic for the third article.

The Bottom Line

Every commercial antivirus product is, by its fundamental architecture, anti-privacy by design. They scan everything, they upload everything, and they monetize or leak everything — or create the infrastructure that makes future monetization and leakage inevitable. The GDPR wasn't written for a world where security software doubles as surveillance software, but that's the world we live in.

If you're processing personal data under GDPR and you've deployed a cloud-connected AV across your fleet, you're gambling with fines that can reach 4% of global annual turnover. The Czech DPA has already set the precedent — a €13.9 million fine confirmed as final and enforceable in April 2024.⁶ More decisions are coming.

The question isn't whether your antivirus violates GDPR. The question is who gets fined first — you, or your vendor.

---

This is the first in a series of articles laying the philosophical infrastructure behind dropQbsd — compartmentalization without virtualization, built on OpenBSD. The next article proves that "privacy-respecting closed source software" is a logical contradiction — a square circle. Subscribe to the newsletter to receive it directly.

This article, like the others in this series, was developed through an iterative dialogue with an AI assistant. The ideas, the philosophical framework, the historical connections, and the editorial direction are the author's. The AI served as a tool for structuring, refining, and sharpening those ideas — a narrative instrument wielded by a human hand, not a substitute for one. Disclosure is not a concession. It is the principle the article defends made operational.

---