The study showed that most advertising organizations are
providing some form of notification to users, as well as an opt-out
mechanism; however, the research also suggests that some opt-out
procedures can be confusing or cumbersome, and some of the
advertising organizations are continuing to serve ads based on
The stated intention of the report was to gather data on current
practices relating to Online Behavioural Advertising (OBA), for the
purpose of analysis and discussion. The OPC explicitly noted
that the initiative was not an investigation, nor was it intended
to conclusively identify compliance issues or possible violations
of privacy legislation.
That said, the findings of the research will be instructive to
website owners, ad aggregators and servers, and advertisers
The OPC has previously considered privacy requirements
respecting OBA on several occasions, including issuing guidelines and a policy position document, as well as issuing
findings in at least three decisions dealing with privacy issues
related to the provision of OBA. These previous findings have
The use of such personal information for the purpose of OBA
requires the knowledge and consent of users
Opt-out consent for OBA will generally be considered to be
adequate, provided that certain criteria are met, including that
individuals are provided with clear and understandable notice of
the purposes for which their personal information may be used, and
are able to easily opt-out of the practice
OBA should be limited, to the extent practicable, to
Organizations should avoid tracking children or tracking on
websites aimed at children
The OPC's latest findings indicate that the vast majority of
the ads that its researchers identified as being behaviourally
targeted displayed the AdChoices icon, which both signals
participation in the self-regulatory program administered by the Digital
Advertising Alliance of Canada (DAAC) and provides a
link to information about OBA and an online tool that provides
users with the ability to opt out of behavioural advertising.
Implicitly, the OPC report finds the AdChoices program, when
correctly executed, to be a valid means of complying with privacy
However, the OPC's research also showed that some
advertising organizations used the AdChoices icon inconsistently,
while others never provided any form of notification or
In a small number of instances, the OPC also observed examples
of targeted ads based on sensitive topics that were part of the
OPC's sample search, such as pregnancy tests, bankruptcy,
divorce lawyers and liposuction. As noted above, the OPC considers
that explicit user consent is required in order to employ OBA
techniques with respect to sensitive topic areas. Under
PIPEDA, medical and financial information is almost always
considered to be sensitive, but more generally, personal
information that could lead to personal harm, financial or
reputational damage or embarrassment, or that could reveal deeply
personal or intimate details of the lifestyle and personal choices
of an individual could be considered to be sensitive, depending on
the context and the reasonable expectation of users.
Moreover, the OPC study observed that clicking on the AdChoices
icon did not lead to a consistent experience in terms of how
information about the advertising program was displayed or the
means by which a user could opt-out. In the OPC's study
sample, users were presented with a variety of opt-out interfaces,
accessible by differing means, and with variations in the clarity
of their instructions and ease of use of the opt-out feature.
The study provides an opportunity for organizations within the
online behavioural advertising chain to examine their practices
with respect to privacy compliance, particularly with respect to
the clarity and usability of their opt-out mechanisms, and to
ensure that tracking is not being performed, without explicit user
consent, with respect to sensitive subject areas.
The content of this article is intended to provide a general
guide to the subject matter. Specialist advice should be sought
about your specific circumstances.
To print this article, all you need is to be registered on Mondaq.com.
Click to Login as an existing user or Register so you can print this article.
Register for Access and our Free Biweekly Alert for
This service is completely free. Access 250,000 archived articles from 100+ countries and get a personalised email twice a week covering developments (and yes, our lawyers like to think you’ve read our Disclaimer).