Officials in the Czech Republic have launched an investigation into Avast, one of the Internet’s most popular free antivirus programs, amid accusations the company sold the search history of as many as 100 million users to third parties.

Regulators have initiated what they call a “preliminary” investigation of the company, meaning data gathering is underway. Avast is based in the the Czech Republic but widely used around the world.

“There is a suspicion of a serious and extensive breach of the protection of users’ personal data,” said Ivana Janů, president of the Czech office for personal data protection in a statement. “Based on the findings, further steps will be taken and general public will be informed in due time.”

The investigation comes following reports from PCMag and Motherboard that Avast was selling the user data through its Jumpshot subsidiary. The company said it has stripped users’ personal details from the data, but the publications said it was still easy to tie the browser histories with specific users.

Avast shut down Jumpshot in late January, apologizing for the practices.

“I realize the recent news about Jumpshot has hurt the feelings of many of you, and rightfully raised a number of questions—including the fundamental question of trust,” said Avast CEO Ondrej Vlcek in a blog post at the time. “Protecting people is Avast’s top priority and must be embedded in everything we do in our business and in our products. Anything to the contrary is unacceptable.”

More must-read stories from Fortune: