Bottom Line: Canadian privacy regulators continue to shape the law relating to privacy and social networking websites. Since our annual Update last September, multiple complaints have been investigated against social networking websites, including Facebook and Nexopia. Among other important findings: a) Facebook provided appropriate notice and obtained informed consent in the context of social plug-ins on third-party sites; b) Facebook's emailing of "friend suggestions" to non-Facebook users was found to require clear and adequate notice and a conspicuous opt-out which Facebook implemented; and c) among other things, improvements were recommended to Nexopia's explanation of how it used member profile information to serve ads, third-party cookies and opt-outs.

FACEBOOK

The Office of the Privacy Commissioner of Canada ("OPC") released three Reports of Findings on Facebook over the last year – two of which are particularly relevant to marketers.

PLUG- IN USE

In the first investigation, related to Facebook's use of social plug-ins (the "Like" button and "Recommends" or "Recent Activity" box) on third-party websites, the complaint was found to be "not well-founded." The OPC okayed the social plug-ins on the basis that: (a) Facebook was not sharing its users' personal information with the third-party hosts; and (b) Facebook was providing users with clear, understandable explanations of how the plug-ins employ users' personal information.

FRIEND SUGGESTIONS

The second complaint, relating to Facebook's "Friend Suggestion" feature, was found to be "well-founded and resolved". In this investigation, complainants had received an email invitation to join Facebook that included "friend suggestions" (i.e., a list of Facebook users that the non-user may know based on the non-user's email address and other information available on Facebook such as photo tags). In its Report of Finding, the OPC found that Facebook failed to obtain non-users' consent to use their personal information to generate friend suggestions. However, the OPC was satisfied with the solution Facebook implemented when it began to provide non-users with both clear and adequate notice and a conspicuous opt-out mechanism to enabel non-users to opt-out of having their personal information used for "friend suggestion". The matter was accordingly resolved.

NEXOPIA

Also in February 2012, the OPC responded to the Public Interest Advocacy Centre's complaint against Nexopia, a Canadian social networking website for youth.

The complaint involved six issues, including an allegation that Nexopia did not adequately explain its advertising practices, in particular, how personal information is shared for advertising purposes. The Report of Finding commented on the following two advertising practices:

  • Use of member profile information to serve targeted ads to users. Consistent with a previous finding on this issue, the OPC found that Nexopia's own use of member profile information for advertising purposes and Nexopia's serving of targeted ads to users was acceptable, as long as it provided adequate notification to users. The OPC's conclusion was influenced by the facts that Nexopia is a free service and advertisers receive only aggregate information about Nexopia members.
  • Placement of cookies by third parties, such as advertisers, in the browsers of users and site visitors to track web usage. Citing its December 2011 Privacy and Online Behavioural Advertising Guidelines, the OPC emphasized that individuals "should be able to opt-out of being tracked by third-parties" (which are typically unknown to them).

The OPC recommended that Nexopia update its Privacy Policy to ensure that users are better informed about the use of Nexopia-served advertising, the presence of third-party cookies and how users can opt out of third-party cookies. Further, the OPC recommended that Nexopia use "alternative methods on its website to explain the implications of third party targeted advertising and tracking cookies with respect to users' information, and how users can opt-out of such tracking, e.g. by adjusting their browser settings."

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.