The Office of the Privacy Commissioner of Canada recently released new online advertising Guidelines to help organizations ensure that their online behavioural advertising practices are fair, transparent and in compliance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). [available here].

The guidelines follow on the Report on the 2010 Office of the Privacy Commissioner of Canada's Consultations on Online Tracking, Profiling and Targeting, and Cloud Computing. [available here].

Among other things, the Guidelines remind organizations that the purpose for which an individual's information is to be collected, used or disclosed must be explained in a clear and transparent manner. The Guidelines also acknowledge the challenges that exist with obtaining consent online; however, opt-out consent for online behavioural advertising could be considered reasonable where certain factors are met (see below for the factors). In addition, if an individual cannot decline the tracking or targeting using an opt-out mechanism, then organizations should not be using such technology for online behavioural advertising purposes. In particular, the Guidelines state that, as a best practice, organizations should avoid tracking children and tracking on websites aimed at children.

The Commissioner provides some fairly specific guidance as to what would be considered reasonable steps to take when crafting an opt-out consent. She will be looking at the following factors when assessing whether an opt out is reasonable:

  • " Individuals are made aware of the purposes for the practice in a manner that is clear and understandable – the purposes must be made obvious and cannot be buried in a privacy policy. Organizations should be transparent about their practices and consider how to effectively inform individuals of their online behavioural advertising practices, by using a variety of communication methods, such as online banners, layered approaches, and interactive tools;
  • Individuals are informed of these purposes at or before the time of collection and provided with information about the various parties involved in online behavioural advertising;
  • Individuals are able to easily opt-out of the practice – ideally at or before the time the information is collected;
  • The opt-out takes effect immediately and is persistent;
  • The information collected and used is limited, to the extent practicable, to non-sensitive information (avoiding sensitive information such as medical or health information); and
  • Information collected and used is destroyed as soon as possible or effectively de-identified."

A copy of the Guidelines is available here.

About BLG

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.