Canada’s Privacy Chief Sets Rules for Online Ads

stoddartCanada’s Privacy Commissioner, Jennifer Stoddart, has revealed new guidelines that seek to limit the ways advertisers can track consumer behavior online.

The guidelines, available on the Commissioner’s website, take the view that online behavioral data constitutes personally identifiable information. They state, “Given the scope and scale of information collected, the powerful means available for aggregating disparate pieces of data and the personalized nature of the activity, it is reasonable to consider that there will often be a serious possibility that the information could be linked to an individual.”

This is significant because, under the country’s Personal Information Protection and Electronic Documents Act (PIPEDA), data collectors are required to provide knowledge and consent before collecting or using information that can be tied to an individual.

The guidelines document stops short of insisting on user opt-in consent for cookie-based and other standard forms of online data collection. It does however suggest that publishers and marketers employing advanced tracking tactics may be in violation of the agency’s policy.

It says, “If an individual is not able to decline the tracking and targeting using an opt-out mechanism because there is no viable possibility for them to exert control over the technology used, or if doing so renders a service unusable, then organizations should not be employing that type of technology for online behavioural advertising purposes. At present, this could include, for example, so-called zombie cookies, super cookies and device fingerprinting.” 

In a press release, Stoddart said the use of online behavioral advertising is growing and the Office is concerned privacy rights of Canadian citizens aren’t being respected because many people don’t know how they’re being tracked. Tracking information is oftentimes included in a “long and legalistic privacy policy,” the release states.

Stoddart said, “Some people like receiving ads targeted to their specific interests. Others are extremely uncomfortable with the notion of their online activities being tracked. People’s choices must be respected.”

According to the new guidelines, information about behavioral advertising should be clear, obvious and understandable. In addition, it says accepting participation in online behavioral advertising should not be a condition for Internet usage and consumers must be able to easily opt out of this practice.

A spokeswoman for Google in Toronto told the National Post the company has tried to increase its transparency. The Google Dashboard allows users to see what the company knows about them and its Ad Preferences enable users to edit the information Google uses to target ads to them.

Concerns over data-driven ad targeting have grown in tandem with the rising availability of information generated by browser activity, social media sharing, and other actions. 

In her speech, Stoddart also said marketers must be careful not to knowingly track children or to gather sensitive information, such as health conditions.

The National Post notes a previous investigation by the Office of the Privacy Commissioner of Canada led to privacy changes at Facebook.

Zach Rodgers contributed. 

Related reading