The Office of the Privacy Commissioner of Canada (OPC) released a policy position on online behavioural advertising, which assesses the applicability of Canada’s federal privacy legislation, the Personal Information Protection and Electronic Documents Act (PIPEDA), to online behavioural advertising. A key element of PIPEDA is that individuals provide informed consent to the collection, use and disclosure of their personal information.
Online behavioural advertising is the “tracking and targeting of individuals’ web activities, across sites and over time, in order to serve advertisements that are tailored to those individuals’ inferred interests”.
Online behavioural advertising collects information about an individual’s web activities, such as IP addresses, browser settings, websites visited, search terms, information entered into online forms, transaction or purchase information, and usernames on web services. The OPC considers information collected through online behavioural advertising to be “personal information” as defined in section 2 of PIPEDA. Although such information, alone, may not be information that could identify an individual, it is used to create profiles of individuals which increase the risk of identifying affected individuals.
The OPC also considers online behavioural advertising to be an appropriate purpose for the collection, use and/or disclosure of personal information under PIPEDA. Except for certain tracking techniques that cannot be controlled by individuals and tracking children, opt-out consent is considered an acceptable form of consent provided certain conditions are met. One such condition is that the purpose for tracking and targeting individuals for the online behavioural advertising is clearly explained. Further, individuals must be informed at or before the collection of information, individuals must be easily able to opt-out, the opt-out must be effective immediately and be persistent, the information collected and used must be non-sensitive information, and the information collected and used must be destroyed as soon as possible or be stripped of its identification with individuals.
The OPC does not approve tracking techniques that cannot be controlled by individuals, such as zombie cookies, supercookies, third-party cookies that appear to be first-party cookies and device fingerprinting – because of the lack of ability for an individual to provide consent or withdraw consent.
The OPC also does not approve tracking children and recommends that tracking technologies be avoided on web sites designed for use by children, since it is difficult to obtain meaningful informed consent from children.
For the OPC’s Policy Position on Online Behavioural Advertising, visit:
http://www.priv.gc.ca/information/guide/2012/bg_ba_1206_e.asp
Summary by: Lauren Lodenquai
