The change

Malwarebytes, the antivirus and security company, updated three documents on October 28, 2026: its Privacy Policy, its California Residents Privacy Notice, and its Software License Agreement. The privacy policy had last been updated on August 26, 2026.

The company also added two new names to its list of subprocessors: SpyCloud for dark web and data breach monitoring, and TeamViewer for remote support sessions.

What changed

• Data goes to ad partners. Malwarebytes may share limited information with advertising partners such as Meta to measure and improve its ads.

• Your email, in hashed form. Contact details are turned into a code before sharing, and identifiers such as IP address and ad clicks can be shared too.

• Ads on other platforms. Malwarebytes may now use personal information to market its products “including through advertising on third-party platforms.”

• Free scans use outside data. New free scans check your phone number or email against public records, identity data providers, and breach databases.

• Trials become paid plans. A trial started with a payment method turns into a paid subscription unless you cancel first.

• Support sessions can be recorded. Remote support may be logged and summarized, including with AI tools.

What Malwarebytes shares with Meta

The new Advertising Partners section is short and specific: “We may share limited information with advertising partners, such as Meta, to measure and improve our advertising. This may include contact information, such as your email address, which we convert into a coded (hashed) format before sharing, and online identifiers, such as ad click identifiers, IP address, and identifiers from accounts you use to sign in (such as Facebook).”

Hashing turns an email into a code, but ad platforms can match that code against the hashed emails of their own users. That is how this kind of sharing is used to measure which ads led to a sign-up or a purchase.

The opening of the policy was updated to match. It now says that the use of cookies “and sharing information with advertising partners, may be considered “selling” or “sharing” under applicable U.S. state privacy laws.” The California notice adds that Malwarebytes disclosed four categories of data “to advertising networks and social media platforms for cross-context behavioral advertising.”

For people covered by GDPR, the policy says “Malwarebytes and Meta Platforms Ireland Limited are joint controllers for collecting and transmitting data through Meta’s business tools.”

How to opt out

The policy says: “Where required by law, we do this only with your consent.” Everyone else can opt out by clicking the Your Privacy Choices link in the website footer, visiting the Malwarebytes privacy page, “or by enabling Global Privacy Control.”

Free scans that look you up

Malwarebytes added free scans that show what information about you may be available online. If you use one, it checks your phone number or email “against third-party sources, such as public records, identity data providers, and data breach databases.”

The results can be detailed: “Results may include contact details, address history, date of birth, partial government ID numbers, relatives, public records, and details from known data breaches, such as partially masked passwords.” Malwarebytes says it keeps scan results only briefly, unless you sign up for ongoing monitoring.

The policy also says Malwarebytes may receive your information from “other users of our products, when they submit your information to use certain features.” If that happens and you do not use Malwarebytes, you can still send a privacy request.

Trials now turn into paid plans

The license adds a new rule for trials: “If you provide a payment method to start a trial, your subscription will automatically convert to a paid subscription and renew as described above when the trial ends, at the price disclosed when you started the trial, unless you cancel before the trial ends.” Trials started through the Apple App Store or Google Play follow those stores’ terms.

Remote support and AI summaries

Malwarebytes support staff may now operate the software on your device during a session you approve. The license says: “Back up your data and close anything you do not want us to see first. You are responsible for approving any changes made during a session. We may log and summarize sessions, including with AI tools, as described in the Privacy Policy.”

What did not change

• The policy still says: “We do not sell your personal data to third parties in exchange for monetary consideration.”

• Malwarebytes still says that features which check files, photos, or messages do this on your device and do not send the content to the company, unless a feature says otherwise.

Who this affects

Anyone who visits the Malwarebytes website, uses its apps, or starts a free trial. The ad sharing is about measuring Malwarebytes’ own ads, so it matters most for people who arrive from an ad or sign in with Facebook. The trial rule matters for anyone who enters a card to start a trial on the Malwarebytes website.

Why this matters

Security and privacy tools are now sharing marketing data the same way other software companies do. Recently Cognition, the maker of Devin, began sharing data with ad partners, and an OpenAI ad pixel appeared in CircleCI’s cookie policy.

For a company that buys security software, the privacy policy of that tool is part of its own data trail. A change like this one sits inside a long policy, which is why it pays to monitor vendor terms of service and privacy pages, even for tools you trust.

Potential impact

If you use Malwarebytes, the update raises four practical questions:

• Is Global Privacy Control turned on in your browser, or have you used the Your Privacy Choices link?

• Did you start a trial with a card, and when does it end?

• If you allow remote support, have you closed private files and apps first?

• Does your team’s vendor record list the new ad sharing and the new subprocessors?

How Venpo detected it

Venpo monitors Malwarebytes’ legal pages and flagged the October 28 updates on October 29, 2026, with every inserted and deleted line marked. The record is on the Malwarebytes page on Venpo. Every quote in this article was checked against the redlines and against the live pages at the time of publication.

Business outcome

Teams that see this change can update their vendor records, set opt-outs on company browsers, and track trial end dates before they turn into charges. That is what continuous monitoring of vendor legal changes is for.

Key takeaway

Since October 28, 2026, Malwarebytes may share hashed emails and online identifiers with advertising partners such as Meta, its free trials turn into paid plans unless you cancel, and its support sessions may be logged and summarized with AI tools.