Skip to main content

The Privacy Commissioner of Canada investigated Google’s practices after receiving a complaint from a man with sleep apnea, which interferes with breathing during sleep.CHRISTIAN HARTMANN/Reuters

Canada's federal privacy watchdog has found Google Inc. violated Canadian privacy law through targeted online advertising, a ruling that sends a strong message for the industry to avoid intruding on consumers' personal Internet activity.

The Office of the Privacy Commissioner of Canada on Wednesday made public an investigation that began last year after a man complained about ads targeted to him based on a medical condition. After he searched for a device to help with his sleep apnea, he noticed ads for similar devices when he visited other websites. The ads were delivered by Google's AdSense service.

Now the privacy commissioner is warning the marketing industry it must take greater responsibility in controlling how ads are targeted to people based on personal information revealed through their use of the Web. The privacy commissioner will be taking its message directly to marketers and the companies that operate online advertising networks in the coming weeks and months.

The ruling highlights the common practice of tracking Internet activity for commercial purposes. It also points to the challenges of determining what constitutes sensitive personal information, and of ensuring companies don't cross the line in their use of it.

According to the watchdog, this problem goes far beyond Google – and more decisions such as this one are likely to come.

"If an organization as sophisticated as Google had difficulty ensuring compliance with its privacy policy, surely others have the same challenges," Interim Privacy Commissioner Chantal Bernier said in an interview Wednesday. "The operational challenges are inherent to online behavioural advertising. There is an ambiguity, and a necessity to define what is sensitive information – and how do you monitor billions of ads?"

Google's privacy policy says the targeted ads it sells on its own search engine, and across the Web through its advertising networks, will not use information such as health, race, religion, or sexual orientation to target ads. The investigation found, however, that Google's enforcement of those guidelines needs to be strengthened.

The decision strikes at the heart of how advertising is bought and sold in a digital age. The value of ads online and on mobile devices is based on how closely they can target consumers through their interests, needs, purchasing histories and even their location. But questions are being raised about when targeting is useful, and when it's an intrusion.

In recent years there has been a massive increase in the business of real-time, programmatic bidding – in which online ads are bought and sold through trading desks, based on the audience those ads will reach. That entire system is built on tracking and behavioural targeting – getting to know who Internet users are based on their Web browsing history, and delivering ads to them based on the profile that behaviour represents.

Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) specifies that targeted advertising must avoid using sensitive personal data – such as information about a person's health. The privacy commissioner's investigation confirmed this type of targeting based on sensitive health information did occur, and found that Google was responsible.

Google declined a request for an interview Wednesday. In a statement, a Google spokesperson said: "We've worked closely with the Office of the Privacy Commission throughout this process and are pleased to have resolved this issue."

"One thing that is particularly significant is the finding that Google has to specifically ask to track these kinds of behaviours," said Dan Glover, an intellectual property and technology lawyer and partner at McCarthy Tétrault LLP. "It appears not to be enough just to have a terms of use or a privacy policy that buries this kind of detail somewhere. There needs to be a more pro-active way to get express consent to serve ads to people that touch on a sensitive area."

The industry has begun providing more information about targeted advertising and making it easier to opt out through its "AdChoices" program.

In response to the decision on Wednesday, the Interactive Advertising Bureau of Canada issued a newsletter to its members reminding them of that program and encouraging them to take part.

Consumers' ability to control behavioural advertising is limited: They can clear their browser histories, and even clear cookies, and still find they are targeted. "Super cookies" and "zombie cookies" that revive themselves and help advertisers target even conscientious Web users have been the basis for many complaints around the world, Mr. Glover said.

The Privacy Commissioner will be encouraging more companies to address these concerns.

"There are compliance challenges; they need to have the mechanisms that are up to the task," Ms. Bernier said. "… We're going industry wide."

Google Inc. broke Canada's privacy law by using sensitive information about users' online activities to target them with health-related ads, the country's interim privacy commissioner said Wednesday.

Interact with The Globe