The Office of the Privacy Commissioner of Canada (OPC) has released a more detailed policy position regarding on-line behavioural advertising. This is a must-read for companies conducting on-line behavioural advertising strategies in Canada.
The OPC defines on-line behavioural advertising as advertising that uses information regarding the multiple websites that a person has visited and will usually involve advertisements on multiple websites. The OPC gives the following example: “a user has visited websites about pets in the past, then ads related to pets might be shown on various web sites, even sites that are not related to pets (e.g., an online newspaper).” On-line behavioural advertising differs from 1st party advertising where the organization’s advertising is based solely on the profile of an individual with whom that organization has a relationship and is not based on tracking the individual across websites.
Some highlights from the position paper:
- The OPC will generally consider information collected during on-line behavioural advertising to be personal information. The OPC acknowledges that some information does not appear at first glance to be personal information when segmented. Nevertheless, the OPC reaches the default position that the information that is collected is personal information on the basis that (1) “the purpose behind collecting information is to create profiles of individuals that in turn permit the serving of targeted ads” and (2) the nature of on-line behaviour advertising is such that it involves “powerful means [...] for gathering and analyzing disparate bits of data and the serious possibility of identifying affected individuals”; and, perhaps circularly, (3) the result of on-line behavioural advertising is “highly personalized”.
- On-line behavioural advertising is not an unreasonable use of personal information. The OPC acknowledges that the model for the commercial websites requires, in many cases, consumers accept advertising in return for access to free websites. However, the OPC also states that submission to on-line behavioural advertising is not a term or condition of use of the Internet. Advertisers must obtain meaningful consent, limit collection and safeguard information in accordance with Canadian privacy legislation.
- Opt-out consent may be acceptable. In order to rely on opt-out consent, advertisers should meet what are essentially three conditions.
- Individuals must have the ability to easily op-out of the practice. Ideally this is to occur before or at the time the information begins to be collected. The opt-out technology must permit the opt-out to be immediate and persistent. Consumers can’t be required to send an e-mail or snail mail request that will be dealt with in days.
- The information collected should be limited and should be destroyed or de-identified as soon as possible. The OPC wants to put sensitive information (examples include health/medical information) off-limits. Information should not be kept indefinitely but have a time-horizon and destroyed or de-identified.
- Technologies that do not permit an individual to opt-out easily cannot be used. If an individual cannot control the technology by opting-out easily or would have to take extraordinary measures, then the OPC’s position is that they should not be used. Essentially, these technologies do not offer any meaningful way to withdraw consent as is required by Canadian privacy laws.
- Personal information from young children should not be collected through on-line behavioural advertising. Older children’s consent must be meaningful although the OPC recommends against on-line behavioural tracking of all children. The OPC’s position is that it is difficult to obtain meaningful consent for young children (even from their parents). In terms of older children, the OPC’s position is that the disclosure and manner in which consent is obtained must be meaningful for the targeted age-group and the context.