News Release

Sensitive information used for online ad targeting, research finds

GATINEAU, QC, June 15, 2015 – Online searches for sensitive topics such as pregnancy tests or divorce lawyers can sometimes lead to related ads appearing on your computer screen, new research by the Office of the Privacy Commissioner of Canada (OPC) has found.

“While we found many examples of good privacy practices related to online behavioural advertising, it’s clear the industry still has some work to do,” says Privacy Commissioner of Canada Daniel Therrien.

“In a small but troubling number of cases, we were disappointed to still find some sensitive information being used to target ads without opt-in consent.”

The OPC today released a research report after looking at the online behavioural advertising that appears on major websites popular in Canada in order to gather data for analysis and discussion, and to raise awareness about privacy protection.

The OPC found that online behavioural advertising – which involves tracking consumers’ online activities across websites over time, in order to deliver ads targeted to inferred interests – was appearing on just over half of the websites examined, and the ads were placed by a variety of advertising organizations.

Most advertising organizations were providing some form of notification of online behavioural advertising and an ability to opt out of such ads, the research found. In fact, the OPC was pleased to see that the vast majority of targeted ads examined involved non-sensitive information and appeared with notification and an opt-out option.

However, some shortcomings were identified. Researchers found a small number of targeted ads that were related to sensitive topics without opt-in consent, and ads related to non-sensitive topics that were not accompanied by notification or an opt-out option. Also, in many cases the procedures for opting out were overly complicated.

The research involved both manual and automated tests where a computer program was used to control a web browser and instruct it to visit a number of sites related to a particular topic. Once that was done, researchers visited general interest sites – news and weather sites, for example – to look for ads related to the topic that had been tested.

The tests involved both non-sensitive topics such as European travel, digital cameras, and golfing, but also several sensitive topics. Testing identified multiple examples where ads were targeted based on prior online activities related to sensitive topics – specifically: pregnancy tests, bankruptcy, liposuction, divorce lawyers, and depression.

The OPC’s online advertising guidance, issued in 2011 and shared with industry, makes clear that advertisers who rely on an opt-out model of consent should avoid collecting sensitive personal information, such as health information, for the purpose of delivering online behavioural ads.
The guidance document says information about behavioural advertising should be clear, obvious, and understandable. Even for non-sensitive topics, accepting participation in online behavioural advertising should not be considered a condition for people to use the Internet generally and people must be able to easily opt out.

The new OPC research report says that, although opt-out options were widely offered, the actual processes to opt-out left much to be desired. Information provided was not always clear, it was often difficult to find the opt-out option, and users who wanted to opt out across different advertising organizations were faced with multiple interfaces and websites.

“Some people like online behavioural advertising because the ads they see are more relevant to their interests. However, others do not like to be tracked and targeted in this way and the opt-out procedures for them need to be clear, consistent, and usable,” says Commissioner Therrien.

The OPC is following up with three advertising organizations that used sensitive information without appropriate consent. As well, the Office recently met with digital advertising industry stakeholders to discuss the research findings and encourage the industry to re-examine their practices and make improvements to opt out procedures and notification.

About the Office of the Privacy Commissioner of Canada

The Privacy Commissioner of Canada is mandated by Parliament to act as an ombudsman and guardian of privacy in Canada. The Commissioner enforces two laws for the protection of personal information: the Privacy Act, which applies to the federal public sector; and the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada’s federal private sector privacy law.

- 30 -

Language selection

Search and menus

Search

News Release

Sensitive information used for online ad targeting, research finds

About the Office of the Privacy Commissioner of Canada