Norton vs Malwarebytes

Norton (Gen Digital) collects some of the most sensitive personal data of any consumer service — Social Security numbers, bank account details, driver's licence numbers, and mother's maiden name for LifeLock identity monitoring — while simultaneously running a targeted advertising business that shares user, device, and website data with advertising partners; network traffic and screen activity are monitored for security purposes; and data flows broadly across Gen Digital's corporate group, distributors, resellers, marketing partners, and analytics providers, all retained for vaguely defined periods.

Malwarebytes has noticeably better specific privacy practices than comparable US security companies — IP addresses are explicitly not stored, the VPN has a detailed and specific no-logs commitment, text messages are scanned without being retained, cloud storage scan files are deleted immediately after scanning, and usage/threat statistics collection can be opted out of in product settings — but it is a US company (Santa Clara, CA) with no named security certifications in its policy, vague retention periods, and a website advertising tracking stack.