Canada’s privacy commissioner has initiated a review of websites viewed by Canadians to ensure compliance with its guidance on the use of online behavioural advertising (see Policy Position on Online Behavioural Advertising).

The privacy commissioner defines OBA to include the tracking and targeting of individuals’ web activities, across sites and over time, in order to serve advertising that is tailored to those individuals’ inferred interests. Such tracking is normally achieved using technologies such as cookies, web beacons and device data.

The privacy commissioner’s guidance (see above link) indicates that the use of OBA is permissible if:

  • Individuals are made aware of the purposes for the tracking practices in a clear and understandable way that is obvious and not buried within a privacy policy. Various communication methods such as online banners, layered approaches and interactive tools may be considered
  • Individuals are informed of the use of OBA at or before the time of collection and provided with information on the parties involved
  • There is an ability to “opt-out” of OBA practices that takes immediate effect and is persistent
  • The information collected is limited to non-sensitive information (for example, searches relating to health conditions should not be tracked)
  • The information collected and used is destroyed or de-identified as soon as possible.

The guidance also indicates that it is not permissible to use tracking tools that an individual cannot stop or control without extraordinary measures, nor should OBA be targeted at children.

In the recent announcement of its OBA investigation, the privacy commissioner stated that informal observations of major websites viewed by Canadians shows that privacy compliance (as it concerns OBA) may be an issue.

The privacy commissioner plans to “research and communicate” the degree that organizations are acting in compliance with PIPEDA, and to disseminate the results in the spring of 2015.