News

News Release

New online advertising guidance sets out restrictions for tracking

Privacy Commissioner of Canada Jennifer Stoddart calls on organizations involved in online behavioural advertising to provide better information about their practices; says the tracking of children and use of tracking technologies that can’t be turned off should be off-limits.

TORONTO, December 6, 2011 – Advertisers who use targeted online ads need to be upfront with Canadians about what they’re doing and must make it easy for people to say No to being tracked, says Privacy Commissioner of Canada Jennifer Stoddart.
 
The Commissioner today launched new guidelines on online behavioural advertising which also set out restrictions on the tracking of children and tracking technologies that people can’t turn off.  Behavioural advertising involves tracking consumers’ online activities over time, in order to deliver advertisements that are targeted to their inferred interests.
 
“The use of online behavioural advertising has exploded and we’re concerned that Canadians’ privacy rights aren’t always being respected,” says Commissioner Stoddart, who launched the guidelines in a speech to the Marketing and the Law conference in Toronto.
 
“Many Canadians don’t know how they’re being tracked – and that’s no surprise because, in too many cases, they have to dig down to the bottom of a long and legalistic privacy policy to find out.”
 
The new guidance document says information about behavioural advertising should be clear, obvious and understandable.  Accepting participation in online behavioural advertising should not be considered a condition for people to use the Internet generally.  People must be able to easily opt out of this practice.

“Some people like receiving ads targeted to their specific interests.  Others are extremely uncomfortable with the notion of their online activities being tracked.  People’s choices must be respected,” says Commissioner Stoddart.
 
She also flagged some important restrictions when it comes to online behavioural advertising.
 
“If an individual can’t say no to the technology being used for tracking or targeting, then the industry shouldn’t use that technology for behavioural advertising purposes,” she told the advertising industry conference.  “So, in the current online behavioural advertising environment, that means no use of web bugs or web beacons, no super cookies, no pixel hacks, no device fingerprinting and no to any new covert tracking technique of which the user is unaware and has no reasonable way to decline.”

Another restricted area involves the online tracking of children.  The guidelines state that organizations should avoid knowingly tracking children and tracking on websites aimed at children. 

“Children are not likely able to provide the meaningful consent required under our privacy law for the tracking of their online activities.  This is an increasingly important issue as we see the average age of first-time Internet users dropping,” says the Commissioner.

The guidelines also say advertisers should avoid collecting other sensitive information, such as individuals’ health information.

Commissioner Stoddart says her Office developed the guidance document to help organizations involved in online behavioural advertising ensure their practices are fair and transparent and in compliance with Canada’s federal private-sector privacy law, the Personal Information Protection and Electronic Documents Act, or PIPEDA.

“The approach we’re taking – as prescribed under Canadian law – is reasonable.  It allows industry to be innovative and to grow while respecting individuals’ right to privacy.”

The Privacy Commissioner of Canada is mandated by Parliament to act as an ombudsman and guardian of privacy in Canada. The Commissioner enforces two federal laws for the protection of personal information: the Privacy Act, which applies to the federal public sector; and the Personal Information Protection and Electronic Documents Act (PIPEDA), which applies to commercial activities in the Atlantic provinces, Ontario, Manitoba, Saskatchewan and the Territories. Quebec, Alberta and British Columbia each has its own law covering the private sector. Even in these provinces, PIPEDA continues to apply to the federally regulated private sector and to personal information in interprovincial and international transactions.

Related documents:

- 30 -

For more information (media only), please contact:

Valerie Lawton
Office of the Privacy Commissioner of Canada
E-mail: Valerie.Lawton@priv.gc.ca

NOTE: Journalists are asked to please send requests for interviews or further information via e-mail.