On December 6, 2011, the Office of the Privacy Commissioner of Canada (OPC) released its Guidelines on Privacy and Online Behavioural Advertising. These Guidelines outline best practices relating to online advertising in order to assist advertisers, websites, browser developers and other organizations involved in online behavioural advertising in complying with Canada's federal private-sector privacy statute, the Personal Information Protection and Electronic Documents Act (PIPEDA). Below is a brief background on behavioural advertising, the steps previously taken by the OPC in this regard, and an outline of the new Guidelines.
BACKGROUND
What is Behavioural Advertising?
Behavioural advertising is a form of advertising or marketing that targets specific consumers based upon their behaviours and preferences. Online, behavioural advertising is facilitated by numerous tracking tools that permit organizations to collect consumer data and link such data to advertisements.
One such tool is a cookie. A cookie is a small file that websites automatically install on users' computers to keep track of online behaviours. Cookies can collect various types of information, including Internet Protocol (IP) address information; pages visited; length of time spent on each page; advertisements viewed; articles read; purchases made; entered terms, such as search terms; user preferences; operating system; and geographical location. Cookies are useful for online advertisers, as they can reveal information pertaining to users.
Other popular behavioural advertising techniques involve the use of marketing platforms that gather the disclosed interests and passions of users in order to provide those users with targeted advertising. Some search engines can track users' search queries and collect information about their surfing patterns and habits, while some social networking sites allow advertisers to access the information provided by users themselves in order to help direct advertising campaigns to specific demographic groups.
Consultations and Investigations by the OPC
Following public consultations held in the spring of 2010, the OPC released a report on the subject of online tracking, profiling and targeting, and cloud computing. The report outlined, among other things, the benefits and risks of online behavioural advertising, as well as the self-regulatory measures in place. The OPC looked particularly to privacy issues arising as a result of online tracking, profiling and targeting. In particular, the report set out two significant issues: the blurring of the public and private divide and its effects on reputation; and the need to protect children online. The OPC's report may be accessed here.
Subsequent to the release of this report, the OPC undertook specific research and outreach activities, as well as policy development, in relation to online tracking, profiling and targeting. The release of its latest Guidelines on Privacy and Online Behavioural Advertising comes in the wake of such initiatives.
THE GUIDELINES
Personal Information and Application of PIPEDA
The OPC's Guidelines on Privacy and Online Behavioural Advertising propose that, given the scope and scale of information collected by cookies and other such tracking devices, as well as the means currently available for aggregating disparate pieces of data, it is reasonable to consider that personalized information collected online by advertisers, although potentially anonymous or anonymized, might eventually be linked to an individual. Thus, the OPC has taken the position, in its Guidelines, that the information involved in online tracking and targeting will generally constitute personal information for the purposes of the application of PIPEDA.
Consent — Fair and Transparent Practices
The Guidelines propose that the collection of user information, such as an individual's web browsing activity and the effecting of online behavioural advertising practices, must be fair, transparent and compliant with the privacy requirements set out in PIPEDA. Specifically, the OPC proposes that, in order to bring online behavioural practices in compliance with PIPEDA, advertisers should seek to obtain user consent to the collection of information. The OPC suggests that such consent may be obtained through the use of an opt-out mechanism, provided such mechanism is clear and understandable, performed at or before the time of collection, immediately effective and persistent, and easily accessible. By way of example, the OPC identified a variety of communication methods, such as online banners, layered approaches, and interactive tools.
Children
Finally, the OPC considered the difficulty in ensuring meaningful consent from a child to online behavioural advertising practices. The OPC suggests in its Guidelines that, as a best practice, organizations should avoid tracking children's online activities and should not track users on websites aimed at children. The Guidelines do not specify who is considered a "child."
The OPC's Guidelines on Privacy and Online Behavioural Advertising may be viewed here.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
