The Office of the Privacy Commissioner of Canada has shown admirable persistence in investigating a complaint against Google Inc.
A Canadian man who suffers from sleep apnea – a temporary cessation of breathing – had searched the Internet for information about "continuous positive airway pressure" devices, which can relieve that condition. After that, ads for CPAP devices relentlessly pursued him as he travelled to other websites. He'd shut down his computer and restart, but to no avail. He kept seeing those ads.
Sleep apnea isn't an embarrassing condition, but it is a private medical matter. If Google ends up populating the websites you visit with car ads, after you do Internet searches when you want to buy a new car, that's legal. But Canadian privacy law says that companies must ask for explicit consent to use sensitive information in targeting online ads – and personal health is a sensitive matter.
Privacy commission staff were assiduous in replicating the complainant's CPAP searches, and they got results very similar to his. Google Inc.'s own attempts to liberate the complainant from the ads were ineffective. The company believed, apparently in good faith, that it had solved the problem when it hadn't – as the privacy commissioner was able to show.
Challenging, but legally required. Google's privacy policies are already very similar to those of Canadian privacy law. With the considerable help of the privacy commissioner, one Canadian showed an enormous corporation that it is not putting its own privacy policies into effect.