OTTAWA – Google violated Canada’s privacy laws when it used “sensitive information” about a man’s online activities to target him with health-related advertisements, the interim privacy commissioner said Wednesday.
The Office of the Privacy Commissioner of Canada investigated a complaint from a man with sleep apnea, a condition which affects breathing during sleep. After searching online for medical devices to treat the condition, the man said he was “suddenly followed" by advertisements for such devices when he visited websites completely unrelated to the sleep disorder, such as news and weather.
The investigation confirmed the complainant's experience, and determined that a cookie had been placed in the complainant's browser after he visited specific sites. The cookie ultimately triggered ads for sleep apnea devices to appear on the complainant's screen when he visited websites that used Google's advertising services.
While behavioural advertising is not illegal, guidelines issued by the Office of the Privacy Commissioner two years ago make clear that advertisers should avoid collecting sensitive personal information, such as individuals' health information, for the purpose of delivering tailored ads.
Google's own privacy policy states that, when tailored ads are shown, the company will not associate a cookie or other identifiers with sensitive categories like race, religion, sexual orientation or health. In response to the investigation’s findings, Google agreed to upgrade the system that reviews ads for compliance, increase the monitoring of ads, and provide more information to advertisers and staff about the rules on 'remarketing campaigns', which allow an advertiser to target ads to recent visitors to their site. Google pledged to implement these steps by June.
"We are pleased Google is acting to address this problem. Most Canadians consider health information to be extremely sensitive. It is inappropriate for this type of information to be used in online behavioural advertising," said Interim Privacy Commissioner Chantal Bernier, in a statement. "As Canadians spend more and more time online, they create a digital trail that can reveal a great deal about a person. Organizations such as Google must ensure privacy rights are respected in this complex environment."
Bernier also expressed concern as to whether other advertising networks are complying with Canadian privacy law, and promised to contact “various advertising stakeholders in the near future to share these investigation results and remind them of their privacy obligations."
www.priv.gc.ca
