Canada’s federal privacy watchdog has found Google Inc. violated Canadian privacy law through targeted online advertising, a ruling that sends a strong message for the industry to avoid intruding on consumers’ personal Internet activity.
The Office of the Privacy Commissioner of Canada on Wednesday made public an investigation that began last year after a man complained about ads targeted to him based on a medical condition. After he searched for a device to help with his sleep apnea, he noticed ads for similar devices when he visited other websites. The ads were delivered by Google’s AdSense service.
Now the privacy commissioner is warning the marketing industry it must take greater responsibility in controlling how ads are targeted to people based on personal information revealed through their use of the Web. The privacy commissioner will be taking its message directly to marketers and the companies that operate online advertising networks in the coming weeks and months.
The ruling highlights the common practice of tracking Internet activity for commercial purposes. It also points to the challenges of determining what constitutes sensitive personal information, and of ensuring companies don’t cross the line in their use of it.
According to the watchdog, this problem goes far beyond Google – and more decisions such as this one are likely to come.
The decision strikes at the heart of how advertising is bought and sold in a digital age. The value of ads online and on mobile devices is based on how closely they can target consumers through their interests, needs, purchasing histories and even their location. But questions are being raised about when targeting is useful, and when it’s an intrusion.
In recent years there has been a massive increase in the business of real-time, programmatic bidding – in which online ads are bought and sold through trading desks, based on the audience those ads will reach. That entire system is built on tracking and behavioural targeting – getting to know who Internet users are based on their Web browsing history, and delivering ads to them based on the profile that behaviour represents.
Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) specifies that targeted advertising must avoid using sensitive personal data – such as information about a person’s health. The privacy commissioner’s investigation confirmed this type of targeting based on sensitive health information did occur, and found that Google was responsible.
Google declined a request for an interview Wednesday. In a statement, a Google spokesperson said: “We’ve worked closely with the Office of the Privacy Commission throughout this process and are pleased to have resolved this issue.”
The industry has begun providing more information about targeted advertising and making it easier to opt out through its “AdChoices” program.
In response to the decision on Wednesday, the Interactive Advertising Bureau of Canada issued a newsletter to its members reminding them of that program and encouraging them to take part.
Consumers’ ability to control behavioural advertising is limited: They can clear their browser histories, and even clear cookies, and still find they are targeted. “Super cookies” and “zombie cookies” that revive themselves and help advertisers target even conscientious Web users have been the basis for many complaints around the world, Mr. Glover said.
The Privacy Commissioner will be encouraging more companies to address these concerns.
“There are compliance challenges; they need to have the mechanisms that are up to the task,” Ms. Bernier said. “… We’re going industry wide.”
And ... one of the comments there that made me really sad ...
I have a disturbing but very true example from unfortunate real life experience.
I don't know where to go with this comment/complain but I would like to make my story known by someone who might help me do something about it.
In 2013 I had planned to commit suicide. Without getting into any unnecessary details, I had planned to do so in a hotel. During my months of obsessive planning, I scoured the internet to find out exactly where I was going to carry out my plans.
My plan ended up being foiled. Someone close to me had suspicions two days before I had intended on carrying out my plan. I was committed against my will and ended up hospitalized for a few months.
I can't say I'm 100%, but I am in a much better place than I was six months ago. I have a team of mental health professionals who are helping me through my struggles.
I had left my suicide plan behind me; tried to forget about it so I could move on and stop obsessing about the past.
Currently, most days of the week, are ads for the very hotel that I had selected to kill myself in.
I see their logo, their name, flash before my eyes more days than not. It torments me. On good days, I have the strength to close the browser and walk away from my computer. I don't indulge the thoughts. But on bad days, it's all I can see. I visit their website again, and the fantasies, the obsessions return.
How do I get these ads to take a hike? Every time I see them I take a huge step back, and my head becomes filled with all the old thoughts that had plagued me, and almost lead to my death.
This has to stop.