I meant that it's not OK to collect clickstream data. At all. As I recall, Apple got nailed about Safari doing that, and stopped.

I think that's splitting hairs, and focusing on the wrong aspect of it. Avast gives clickstream data to a digital marketing company. That company happens to be a subsidiary, so Avast is a digital marketing company. The problem becomes one not of a company sharing your private information with another so it can me monetized, but the initial company monetizing it itself. If you have a problem with your data being used for marketing by your AV vendor, whether it's shared to make it happen is likely of little consequence to you.

Not certain of specifics of this case but in general absolutely no! As a data controller you collect users' data for a purpose. If you use that data for a seprate purpose you need seperate consent from users to use their data.

Why is the data even being collected?