CCleaner Online Installer
Gen Digital Inc. (Piriform)
The CCleaner installer collects 21 SMBIOS hardware identifiers, system specs, and behavioral telemetry. A Shepherd configuration request containing tracking identifiers fires before the user consents. All data goes to analytics.avcdn.net. No Google Analytics or third-party sharing, but the hardware fingerprinting is aggressive — reading serial numbers from motherboard, CPU, RAM, disks, battery, and power supply.
Grade Breakdown
Weighted score: 58/100Pre-consent Shepherd request fires with tracking IDs before any UI. Hardware fingerprinting also pre-consent. Not the worst (only 1 network request), but still collects before consent.
21 SMBIOS hardware identifiers is excessive for an installer. Battery SN, PSU SN, and chassis tag have no functional purpose. System info collection is reasonable.
No privacy notice in the installer UI. Privacy policy on website mentions device identifiers but doesn't enumerate scope. HTTPS-only transport is transparent. Single endpoint is simple.
HTTPS-only for all endpoints. Fingerprint encrypted with Windows DPAPI. DSA signature verification for downloads. No plaintext HTTP fallback. Good security posture.
Pre-consent data collection contradicts implied consent model. Scope of fingerprinting (21 identifiers) not disclosed in installer. No regulatory action, but practices exceed what policy describes.
Findings
Pre-Consent Collection
Shepherd configuration request fires before user consent
ccl-pre-001On binary launch (before any install dialog is shown), a GET request is sent to shepherd.avcdn.net with tracking identifiers including track-guid and marketing cookie in the query string. This constitutes data processing before obtaining consent.
GET https://shepherd.avcdn.net/?product=piriform-ccl&cookie=mmm_ccl_003_999_aab_m&guid=... fires in Phase 1 before UI display.
Hardware fingerprint computed before consent
ccl-pre-002All 21 SMBIOS identifiers are read and the composite fingerprint is computed during binary initialization, before the user sees any installation dialog or consent mechanism.
Phase 1 timeline: APEF overlay parsed → hardware fingerprint computed → track-guid read → Shepherd request sent. All before Phase 2 (UI display).
Hardware Fingerprinting
Reads 21 SMBIOS hardware identifiers
ccl-hw-001The device_identifier class (FUN_004b3250, 3,833 bytes) reads SMBIOS/DMI firmware tables for serial numbers of motherboard, CPU, RAM, disks, battery, power supply, and chassis. These are combined into a composite fingerprint that survives OS reinstallation.
FUN_004b3250 @ 0x004b3250 — SMBIOS reader. Types: 1 (System), 2 (Baseboard), 3 (Chassis), 4 (Processor), 17 (Memory), 22 (Battery), 39 (PSU). 21 individual identifiers extracted.
Fingerprint encrypted with Windows DPAPI and stored persistently
ccl-hw-002The composite hardware fingerprint is encrypted via LocalEncryption (Windows CryptProtectData/CryptUnprotectData) and stored via asw::permanent_storage. Log messages confirm active management: 'Fingerprint source data are updated.', 'Storing the new fingerprint'.
Tracking & Identifiers
Persistent track-GUID survives uninstall
ccl-track-001A tracking GUID is stored in HKLM registry and persists across uninstall/reinstall cycles. Used to correlate installations across time.
FUN_0040baa0 @ 0x0040baa0 — Track-GUID manager. FUN_004682b0 @ 0x004682b0 — GUID initializer on first run. Stored in HKLM, survives uninstall.
Marketing attribution cookie embedded in binary
ccl-track-002A marketing cookie (mmm_ccl_003_999_aab_m) is embedded in the APEF overlay of the binary and transmitted with telemetry. Used for campaign attribution and partner tracking.
Cookie extracted from APEF overlay, included in Shepherd request and analytics payload. Format: mmm_ccl_003_999_aab_m.
Telemetry
9,647-byte telemetry payload builder
ccl-tel-001FUN_0046d590 (the largest function in the binary) assembles a comprehensive JSON payload including hardware fingerprint, system info, tracking identifiers, installation events, and product details. Sent to analytics.avcdn.net/v4/receive/json/25.
Full command line captured and transmitted
ccl-tel-002The installer captures the full command line used to launch it (cmdline JSON key) and includes it in the telemetry payload. This could expose file paths, user directories, or other contextual information.
Network Endpoints
Single analytics endpoint with HTTPS-only transport
ccl-net-001All telemetry goes to analytics.avcdn.net/v4/receive/json/25 over HTTPS. No plaintext HTTP fallback. No third-party analytics (unlike Avast). User-Agent: 'Icarus Http/1.0'.
GDPR / Privacy Regulation
GDPR Art. 6 — Processing without lawful basis
ccl-gdpr-001Pre-consent Shepherd request transmits tracking identifiers to Gen Digital servers before any consent is obtained. No lawful basis (consent or legitimate interest) established for this processing.
Shepherd GET request with tracking GUID + marketing cookie fires in Phase 1, before any UI or consent mechanism.
GDPR Art. 5(1)(c) — Excessive hardware fingerprinting
ccl-gdpr-002Collecting 21 hardware serial numbers (including battery, power supply, and chassis serial numbers) is excessive for an installer that only needs to download and run a setup binary.
21 SMBIOS identifiers from 8 table types. Battery SN and Power Supply SN have no functional purpose for installation.
GDPR Art. 13 — No privacy notice at point of collection
ccl-gdpr-003No privacy notice or data collection disclosure is shown before the Shepherd request fires and hardware fingerprinting begins.
Phase 1 (binary launch) proceeds directly to data collection. Phase 2 (UI display) shows installation dialog with no privacy notice.
Policy Adherence
Pre-consent data collection contradicts implied consent model
ccl-policy-001The installer begins collecting data (hardware fingerprint + Shepherd request) before showing any UI, contradicting the implicit consent model where clicking 'Install' would constitute consent. Data is processed before consent can be given.
Phase 1 data collection precedes Phase 2 UI display. Shepherd request with tracking IDs fires before any user interaction.
Scope of hardware fingerprinting not disclosed in installer UI
ccl-policy-002The installer UI does not mention that 21 hardware identifiers are being read from SMBIOS firmware tables, including battery and power supply serial numbers.
No disclosure in installer dialog. Privacy policy on piriform.com/privacy mentions 'device identifiers' but does not enumerate 21 specific SMBIOS reads.
+Positive Findings
No Google Analytics or third-party analytics
ccl-pos-001Unlike Avast (same parent company), CCleaner does not integrate Google Analytics, does not share data with third parties, and uses only Gen Digital's own analytics endpoint.
No GA measurement IDs, no GA endpoints, no third-party analytics domains found in 10,841 ASCII + 1,389 Unicode strings.
No network interception or DNS manipulation
ccl-pos-002The installer does not install kernel drivers, does not perform DNS interception, and does not inspect network traffic. It is limited to download-and-run functionality.
No kernel driver installation, no DNS APIs, no packet capture. Binary scope is limited to SFX unpacker + HTTP downloader.
Does not collect email, username, MAC, browsing, or clipboard data
ccl-pos-003Exhaustive string analysis confirms absence of: email collection, GetUserName/GetComputerName in telemetry path, MAC address APIs, browser data access, clipboard APIs, keyboard hooks.
Full string scan of 10,841 ASCII + 1,389 Unicode strings. No GetAdaptersInfo, GetUserName, or browser-related APIs in telemetry code paths.
Methodology
Static analysis via Ghidra decompilation of icarus_sfx PE32 binary (7,188 functions, 306,803 lines). String extraction (10,841 ASCII + 1,389 Unicode). RTTI class recovery (24 asw:: namespaces, 150 classes). No dynamic analysis.
Compare with other software
See how this product's data practices compare side-by-side.
View Comparison