Canada's privacy law, the Personal Information Protection and Electronic
Documents Act (PIPEDA), requires an individual's knowledge
and consent for the collection, use or disclosure of personal
information. PIPEDA also requires that the purposes for which
an individual's information is to be collected, used or
disclosed be explained in a clear and transparent manner.
The Office of the Privacy Commissioner determined that the
information involved in online tracking and targeting for the
purpose of serving behaviorally targeted advertising to individuals
constitutes personal information under PIPEDA. Therefore,
"any collection or use of an individual's web browsing
activity must be done with that person's knowledge and
consent." However, the form of consent can vary:
"for example, express consent (opt-in) when dealing with
sensitive information, and implied consent (opt-out) when the
information is less sensitive." According to the
Guidelines, the sensitivity of information depends on the nature of
the information and the context in which it is being collected,
used or disclosed.
The guidelines specifically address these practices:
Children. The Guidelines discourage
companies from tracking children or tracking on websites aimed at
Technologies that should not be used.
"If an individual is not able to decline the tracking and
targeting using an opt-out mechanism because there is no viable
possibility for them to exert control over the technology used, or
if doing so renders a service unusable, then organizations should
not be employing that type of technology for online behavioural
advertising purposes." In a press release announcing the new Guidelines,
the Privacy Commissioner stated: "So, in the current
online behavioural advertising environment, that means no use of
web bugs or web beacons, no super cookies, no pixel hacks, no
device fingerprinting and no to any new covert tracking technique
of which the user is unaware and has no reasonable way to
Non-sensitive information. The Guidelines
state that opt-out consent for online behavioral advertising could
be considered reasonable provided that:
Individuals are made aware of the purposes for the practice in
a manner that is clear and understandable - the purposes must be
Individuals are informed of these purposes at or before the
time of collection and provided with information about the various
parties involved in online behavioral advertising;
Individuals are able to easily opt-out of the practice -
ideally at or before the time the information is collected;
The opt-out takes effect immediately and is persistent;
The information collected and used is limited, to the extent
practicable, to non-sensitive information (avoiding sensitive
information such as medical or health information); and
Information collected and used is destroyed as soon as possible
or effectively de-identified.
The content of this article is intended to provide a general
guide to the subject matter. Specialist advice should be sought
about your specific circumstances.
To print this article, all you need is to be registered on Mondaq.com.
Click to Login as an existing user or Register so you can print this article.
Register for Access and our Free Biweekly Alert for
This service is completely free. Access 250,000 archived articles from 100+ countries and get a personalised email twice a week covering developments (and yes, our lawyers like to think you’ve read our Disclaimer).