Over the past year, issues relating to online behavioural advertising (OBA) have had the attention of privacy commissioners, data protection authorities and legislators across the globe. Many gallons of ink and hundreds of pages on the Internet have been expended by all of the relevant parties, outlining their various positions on this controversial topic.
This past December, the Office of the Privacy Commissioner of Canada (OPC) weighed in on the topic by issuing a guideline document entitled “
.” The OPC acknowledges that “advertising may help subsidize the delivery of free online content;” however, it stresses that OBA practices must respect individuals’ privacy and their choices to receive or not receive such advertising.
While some participants in the OBA debate would argue the information collected as part of online tracking is not personal information (PI), the OPC found that it was “reasonable to consider that there will often be a serious possibility that the information could be linked to an individual” and therefore would be considered PI as that term is defined in the federal Personal Information Protection and Electronic Documents Act (PIPEDA).
The guideline notes OBA is a “reasonable purpose” under PIPEDA, but organizations may not make OBA a condition of service. Opt-out consent would be considered reasonable, subject to certain conditions; for example, individuals must be made aware of collection for OBA purposes—not buried in a privacy notice—and provided information about the parties involved in OBA. Individuals must be able to opt out, and the opt-out mechanism should be immediate and persistent. Collecting sensitive information should be avoided, and as children are unable to provide meaningful consent, organizations should avoid tracking children and websites aimed at children.
The OPC specifically focuses on technologies that, by their very nature, make it hard to exercise meaningful choice. The guideline cites a number of technologies; e.g. so-called zombie cookies, super cookies and device fingerprinting, which, when used for OBA purposes, do not allow individuals to decline tracking—as there is no way for individuals to exert control over such technologies or doing so would render the service unusable.
It is important for all parties in the OBA space to recognize the balanced approach taken by the OPC. While in many jurisdictions data protection authorities and legislators are taking a very conservative approach to OBA, for example, by recommending opt-in consent, the approach taken by the OPC is measured and reasonable. Organizations should review their current practices to ensure that they are consistent with these guidelines.
