Norton vs Bitdefender

Norton (Gen Digital) collects some of the most sensitive personal data of any consumer service — Social Security numbers, bank account details, driver's licence numbers, and mother's maiden name for LifeLock identity monitoring — while simultaneously running a targeted advertising business that shares user, device, and website data with advertising partners; network traffic and screen activity are monitored for security purposes; and data flows broadly across Gen Digital's corporate group, distributors, resellers, marketing partners, and analytics providers, all retained for vaguely defined periods.

Bitdefender is a Romanian cybersecurity company — EU member state jurisdiction, GDPR enforced by the Romanian DPA — with ISO 27001 and SOC2 Type 2 certifications, an explicit no-data-selling commitment, an anonymisation-first principle for technical data, and no advertising partner data sharing; the main caveats are that individual data processors are not named in the policy, technical security data can be retained for up to ten years, the website privacy policy explicitly provides no advance notice before changes, and marketing emails run on a legitimate interest basis for five years post-cancellation.