New Canadian Privacy Guidelines on Targeted Advertising Released

Earlier in December, the Office of the Privacy Commissioner of Canada (OPC or Commissioner) released guidelines placing restrictions on online tracking. The guidelines require that marketers engage with users about how their personal information is being tracked or gathered, and give users a reasonable opportunity to decline to be tracked. A central theme to Canada’s federal privacy legislation, the Personal Information Protection and Electronic Documents Act (PIPEDA), is that users provide informed consent to the collection, use and disclosure of their personal information. In these new guidelines, the OPC affirms that PIPEDA covers online tracking behaviours. The Commissioner has taken the position that information involved in online tracking and targeted advertising generally constitutes personal information. Arguably, this is an aggressive stance. PIPEDA defines personal information as “information about an identifiable individual”. It will likely be quite fact-specific whether the information gathered in any particular program of targeted advertising relates to a particular and identifiable individual. Nevertheless, marketers should be aware that the Commissioner has taken this stance, since it signals the OPC’s intent to investigate all targeting advertising schemes closely. Fortunately, the guidelines permit a presumption of consent under certain circumstances, so that web pages can default to a targeting advertising scheme, provided that users are given a method of easily opting out. Online tracking systems that prevent a user from opting out are now prohibited. The guidelines also identify that, as a “best practice”, online marketers should avoid tracking children and avoid using tracking on web sites designed for use by children, since it is difficult to obtain meaningful informed consent from children. This is not an outright ban, however, and leaves open the possibility that consent could be obtained from parents directly. Web site operators may consider a mechanism similar one used to comply with the US Children's Online Privacy Protection Act, which requires verifiable parental consent to collect any information online from children under age 13. Summary by: James Kosa For the text of the relevant Guidelines, visit: http://www.priv.gc.ca/information/guide/2011/gl_ba_1112_e.cfm