Avast, headquartered in the Czech Republic, bought US marketing company Jumpshot in 2013. The firm tracks what website users visit, when they visited them and on what device. The allegations also raise questions whether Avast broke GDPR rules, regulations introduced to give individuals control over their personal data.