Online advertisers who balk at following new guidelines for collecting the personal information of web users could become targets of enforcement, Canada's privacy czar said Tuesday.
Releasing the guidance document, Privacy Commissioner Jennifer Stoddart said Internet users should have the clear choice to say no to being tracked.
"We want people to understand what is going on before their personal information is collected," Stoddart said.
Story continues below advertisement
"If we see troubling trends, we will take enforcement action."
At their heart, Ms. Stoddart said, the guidelines are aimed at promoting trust among consumers, which means respecting privacy rights when it comes to collecting personal information.
Many Canadians simply don't know they are being tracked as they browse the web, she said.
"Our daily online roaming leaves an expansive trail of digital bread crumbs that are scooped up, analyzed, and amalgamated into profiles so that companies can try to sell us more of their goods and services," Ms. Stoddart told an advertising industry conference.
Story continues below advertisement
"For the most part, it's happening invisibly."
While some people like receiving advertising tailored to their interests gleaned from their browsing activities, she said, others hate the notion that someone is snooping as they go about their daily web business.
"They're about as uncomfortable with the notion of their online wanderings being tracked as they would be with someone following them literally around the shopping mall," Ms. Stoddart said.
"They find this practice downright creepy."
Story continues below advertisement
Among the new guidelines:
- Users must be able to give meaningful consent to being tracked before or at the time their data is collected.
- Users must know why and for what purpose their personal information is being collected.
- Trackers must limit retention of data.
- Collection of sensitive information such as medical or health data should be avoided.
- Knowingly tracking children or using tracking technologies that people can't turn off are off-limits.
Ms. Stoddart said covert snooping using devices such as web bugs or "super cookies" run afoul of the guidelines because users cannot say no to the tracking.
Also, consumers who opt out of tracking should not find they are then barred from accessing a service, according to the guidelines.
Currently, privacy policies are often buried, or turn out to be long and legalistic, making it difficult for users to give meaningful consent.
Story continues below advertisement
As a result, such policies should be easy to find, read and understand, Ms. Stoddart said.
One area of particular concern to Ms. Stoddart's office is how popular websites automatically forward information to data-tracking aggregators without meaningful consent from surfers.
Another is the placing of third-party tracking cookies on websites.
Ms. Stoddart said online behavioural advertising is a global issue that has "exploded" in recent years, but privacy rights are not always respected. Her colleagues in other countries have similar concerns, she added.
The European Union, for example, now explicitly requires opting in for computer tracking cookies.