What is a PUP (potentially unwanted program)?
Definition
A PUP (potentially unwanted program) is software you didn't knowingly choose to install, often adware or a toolbar bundled with a free download. Some are only annoying, others track you.
- Category
- Attacks
- Also called
- PUA, potentially unwanted application, potentially unwanted software
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
Sources checked: csrc.nist.gov, ftc.gov
Last verified against the official page:
"PUP" is industry shorthand, not an official legal or government category. It covers programs that sit in a grey zone between ordinary software and malware: you may have technically clicked "accept" on an installer, but you didn't really mean to get them.
The usual route is bundling. An FTC staff report on spyware and adware notes that adware is frequently packaged with free software. FTC complaints from that period describe download pages that never told people the extra program would be installed alongside the one they wanted. The same pattern holds today: you grab a free converter or PDF tool, click through the installer, and end up with a browser toolbar, a changed search page or pop-up ads.
Where PUPs end and malware begins
The line is blurry. At the FTC workshop, panelists disagreed about whether consent to a bundled install is enough, and about where legitimate adware stops and spyware starts. NIST's glossary treats spyware and some forms of adware as examples of malicious code, meaning software intended to harm the confidentiality, integrity or availability of a system. So a PUP that only shows ads is a nuisance, while one that watches your browsing or collects your data is a privacy problem.
Why it matters
PUPs can slow your device, change your browser settings and show ads you didn't ask for. The ones that collect browsing activity add to the data trail that data brokers and advertisers build about you. And a program you didn't choose is one you probably aren't keeping up to date.
PUP vs. related terms
How to protect yourself
- 1
Slow down in installers
Choose the custom or advanced install option when there is one, and untick any extra program, toolbar or search setting you didn't come for.
- 2
Download from the publisher's own site or your device's official app store
Free programs from third-party download sites are the common carrier for bundled extras.
- 3
Remove programs and extensions you don't recognize
Check your installed programs list and your browser's extensions, and uninstall anything you didn't choose. Reset your browser's search page and home page if they changed.
- 4
Keep your device and security software updated
Updates close holes that more harmful software relies on, and a current security tool can flag programs it considers unwanted.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
Is a PUP a virus?
Not by definition. A virus is code that infects a host and spreads. A PUP is software you didn't clearly want, which can range from harmless-but-annoying to privacy-invasive.
Is a PUP the same as adware?
Often, but not always. Adware is one common kind of PUP. Others include browser toolbars and software that changes your search settings.
Did I agree to it if I clicked through the installer?
Possibly, in a technical sense. The FTC workshop record shows people disagreed about whether that kind of consent is adequate when the extra program isn't clearly disclosed.
Sources
Something wrong or out of date? Tell us and we'll re-check it.