Avast fined $16.5 million for 'privacy' software that actually sold users' browsing data