Canada's federal privacy watchdog has found Google Inc. violated Canadian privacy law through targeted online advertising, a ruling that sends a strong message for the industry to avoid intruding on consumers' personal Internet activity.
The Office of the Privacy Commissioner of Canada on Wednesday made public an investigation that began last year after a man complained about ads targeted to him based on a medical condition. After he searched for a device to help with his sleep apnea, he noticed ads for similar devices when he visited other websites. The ads were delivered by Google's AdSense service.
Now the privacy commissioner is warning the marketing industry it must take greater responsibility in controlling how ads are targeted to people based on personal information revealed through their use of the Web. The privacy commissioner will be taking its message directly to marketers and the companies that operate online advertising networks in the coming weeks and months.
The ruling highlights the common practice of tracking Internet activity for commercial purposes. It also points to the challenges of determining what constitutes sensitive personal information, and of ensuring companies don't cross the line in their use of it.
According to the watchdog, this problem goes far beyond Google – and more decisions such as this one are likely to come.
The decision strikes at the heart of how advertising is bought and sold in a digital age. The value of ads online and on mobile devices is based on how closely they can target consumers through their interests, needs, purchasing histories and even their location. But questions are being raised about when targeting is useful, and when it's an intrusion.
In recent years there has been a massive increase in the business of real-time, programmatic bidding – in which online ads are bought and sold through trading desks, based on the audience those ads will reach. That entire system is built on tracking and behavioural targeting – getting to know who Internet users are based on their Web browsing history, and delivering ads to them based on the profile that behaviour represents.
Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) specifies that targeted advertising must avoid using sensitive personal data – such as information about a person's health. The privacy commissioner's investigation confirmed this type of targeting based on sensitive health information did occur, and found that Google was responsible.
Google declined a request for an interview Wednesday. In a statement, a Google spokesperson said: "We've worked closely with the Office of the Privacy Commission throughout this process and are pleased to have resolved this issue."
The industry has begun providing more information about targeted advertising and making it easier to opt out through its "AdChoices" program.
In response to the decision on Wednesday, the Interactive Advertising Bureau of Canada issued a newsletter to its members reminding them of that program and encouraging them to take part.
Consumers' ability to control behavioural advertising is limited: They can clear their browser histories, and even clear cookies, and still find they are targeted. "Super cookies" and "zombie cookies" that revive themselves and help advertisers target even conscientious Web users have been the basis for many complaints around the world, Mr. Glover said.
The Privacy Commissioner will be encouraging more companies to address these concerns.
"There are compliance challenges; they need to have the mechanisms that are up to the task," Ms. Bernier said. "… We're going industry wide."