Canadian cannabis websites tracking users’ data, analysis finds

Cannabis websites across the country are tracking their users with up to 13 different tools, a Globe and Mail analysis has found, raising questions about disclosure and privacy in a newly legal industry.

The amount of tracking varies greatly depending on the governmental agency or private company operating e-commerce services in each province, but information on how people’s information is tracked is not always clear. Practices vary from more than a dozen trackers present on one site, all the way down to zero, according to a recent analysis of Canadian cannabis e-commerce sites using Ghostery, an application that detects such tools embedded in many websites.

Some site operators contacted by The Globe said they were not even aware of some of the trackers their sites had enabled. The practice raises questions about whether disclosure to customers is clear enough in explaining how their data are used – particularly during a transaction that, while legal, may be considered sensitive.

In December, the Office of the Privacy Commissioner of Canada published guidance for privacy protection for people and organizations selling cannabis. “While the guidance doesn’t speak to the specific issue [of web trackers], it does speak to the particular sensitivity of cannabis-related transactions,” spokeswoman Valerie Lawton said. “Web tracking certainly adds another dimension that online cannabis consumers may wish to be aware of.”

Analytics tools such as these are present almost everywhere on the internet. Some of the tools, such as Google Analytics, simply provide website operators with information on how their sites are functioning and whether customers may be encountering problems. Trackers can help e-commerce sites to identify whether customers are finding the information they were looking for when they came to the site; friction points that cause people to leave the site before completing a transaction; which merchandise is most popular; and what else people might be looking for when they purchase a certain item.

But others are used for broader purposes, including to target advertising to people as they move across the internet. For example, Facebook deploys trackers across the web to verify how effective Facebook ads are at causing people to visit an advertiser’s website, for example, or buy something there. Facebook also offers a tool called Custom Audiences, allowing advertisers to match lists of their own customers with those people’s Facebook accounts – Facebook says this process is anonymized since the data are first “hashed” and then matched in a way that obscures personal details – in order to target them with ads on Facebook’s platforms. Another example is Google’s DoubleClick tool, which helps publishers place targeted ads on their websites. DoubleClick appeared on many Canadian cannabis websites.

It is unclear why such advertising trackers are present given that sellers of recreational cannabis in Canada are subject to significant restrictions on marketing, which were introduced when the substance was legalized last fall.

Fire and Flower, which offers online ordering for in-store payment and pick-up at its stores in Alberta and Saskatchewan, had the most trackers of the sites analyzed by The Globe using Ghostery. A visit in December showed 15 trackers in use, and another visit the next month identified 13 trackers, eight of them related to advertising: AppNexus, LinkedIn Marketing Solutions and LinkedIn Ads, Bidswitch, SMART AdServer, StackAdapt, Google’s DoubleClick and Facebook Custom Audience. It also contained social-media tracker Facebook Connect, which allows people to log in to a variety of websites using their Facebook ID and login information, and others such as Google Analytics.

Fire and Flower did not respond to questions about its web-tracking practices, replying only in an e-mailed statement that said it ensures “the safe handling of customer data in accordance with the company’s privacy policy."

Some site operators were not aware that they had advertising-related trackers until asked about them by The Globe. Alberta Gaming, Liquor and Cannabis did not know it had DoubleClick on its site, and is looking into when it was placed there. The agency is not using DoubleClick to build audience profiles for marketing purposes, Jon Campbell, the agency’s director of e-commerce, said in an interview.

Cannabis NB in New Brunswick uses Google Analytics, but was also not aware that DoubleClick was on its site until asked about it, spokeswoman Marie-Andrée Bolduc said. “The data is anonymous and was not used for any advertising purposes. However, since this is not data that we require, we have turned off this feature,” she said. DoubleClick was present on other sites such as those operated by the Ontario Cannabis Store, Nova Scotia Liquor Corp. and the Société québécoise du cannabis, but spokespeople for those agencies said they do not actually use the tool.

Even though the rules around advertising and recreational cannabis are strict in Canada, information about cannabis shoppers could still be used in advertising, said Bennett Cyphers, a technologist at the San Francisco-based Electronic Frontier Foundation, which advocates for privacy and digital user rights.

“It wouldn’t even have to be the cannabis companies doing the advertising for these trackers to be useful; there might be a lot of companies that want to reach people that visit cannabis sites to advertise other things to them,” he said.

The presence of Facebook trackers is particularly concerning, Mr. Cyphers said. “It contains potentially really sensitive data.… Unless you’re really vigilant, and you literally do this for a living, it’s pretty much impossible to keep track of all of it.”

Tokyo Smoke, which also operates an online store in Manitoba, uses Facebook Custom Audience and Facebook Connect. In response to questions about why Facebook trackers would be on the site in the first place, parent company Canopy Growth Corp. sent a link to Tokyo Smoke’s privacy policy. The policy states that it may use “third-party website trackers” including Facebook, to analyze how the website is being used, but does not explain why trackers used for social-media advertising would be necessary. “This updated policy has been thoroughly reviewed by our legal team and aligns with our track record of running an e-commerce platform in a highly regulated environment dealing with sensitive medical data/information,” Canopy spokesperson Caitlin O’Hara said in an e-mail.

“As soon as that information is collected by a third-party tracker that might use it for advertising, and then it’s disseminated among potentially dozens or hundreds of different potential advertisers, the consumer really has no way of knowing where that information is going, no way to stop its flow and no way to know what anyone does with it after it’s shared,” Mr. Cyphers said. “So they absolutely deserve to know, and they deserve to opt out and not have their information shared.”

Tweed, which Canopy also owns, operates e-commerce in Manitoba and Nunavut, and uses Adobe analytics and Google Analytics “to understand what content resonates with visitors,” Canopy spokeswoman Caitlin O’Hara said. Asked whether Tweed considered using no trackers, because some customers might consider cannabis purchases to be sensitive information, Ms. O’Hara said this was a “false assumption” and that adults buying legal products have nothing to hide.

Meta Cannabis, which operates an online store in Manitoba, confirmed that it uses trackers including Google Analytics to measure visitor behaviour based on an anonymous session I.D. Another tracker, LiveChat, identifies products a visitor is looking at in order to provide customer service. It also uses e-mail management service Mailchimp and e-commerce software service Shopify, both of which allow for data tracking, according to the company.

“We are certain that we have eliminated any risk of re-identification of the information we collect from our shoppers by anyone. From our online shopping platform, to our payment gateways, to our shipping partners, we have confirmed that the information is kept in a manner that protects our customers from any compromising circumstances,” Meta’s parent company National Access Cannabis said in an e-mail.

Privacy experts caution, however, that even the collection of so-called “anonymized” data can be sensitive: Cookies can identify a user’s device, browsing history and information about their general location. Even when that data are disconnected from a person’s name and other identifiable characteristics, with enough information, it can be relatively easy to triangulate to an individual. As such, researchers have thrown into question whether such “anonymized” data can ever be considered truly anonymous. Many site operators told The Globe that they provide information about their tracking – and the choice to opt out – within their privacy policies. But Mr. Cyphers pointed out that such policies are often not useful to the average site user.

“There should really just be a pop up that says … ‘We collect this type of information, and here’s how we use it. Is that okay with you?’" he said, "That’s the level at which it would start to become useful to real consumers.”

What other online cannabis retailers are tracking

Ontario

The Ontario Cannabis Store uses Google Analytics, DoubleClick, Google Tag Manager and Polyfill. In response to questions about its trackers, spokesman Daffyd Roderick said the store collects information “necessary for each transaction” that is not shared with third parties. Asked why an advertising tracker such as Double Click is needed if the store does not advertise, Mr. Roderick said the OCS “has no plans to buy or sell advertising,” and that the trackers “are an inherent part of the [website’s] platform and there are no plans to use them.”

Quebec

The Société québécoise du cannabis uses DoubleClick, Google Tag Manager, MyFonts Counter and Google Analytics, but only actively uses the last one, spokesman Fabrice Giguère said, to measure how the website is used.

Yukon and NWT

The Northwest Territories Liquor and Cannabis Commission’s online store uses only Google Analytics to monitor site traffic and which pages are visited, spokesman Todd Sasaki said. Cookies on that site are only for age verification, he added.

Cannabis Yukon’s site uses one tracker, called Matomo. The site collects data such as the IP address associated with visits, the type of device, operating system, screen size and web browser, clicks and page visits, among other behaviour. It uses cookies to operate the shopping cart and remember users on repeat visits within 30 days. Its privacy policy instructs users with concerns to disable cookies in their web-browser options, but notes that this could interfere with purchases. “We take privacy seriously and in completing a privacy impact assessment of our site, chose deliberately to keep the use of trackers to a minimum,” Yukon Liquor Corp. spokesman Scott Westerlaken said.

B.C.

The BC Liquor Distribution Branch says that its BC Cannabis Store site only tracks basic information such as number of visits and page views, and does not track IP addresses, location or demographic information of people who make purchases. Only one tracker is present on the site, called MyFonts Counter, which is operated by a company from which the website licenses its font design. It counts page views to determine the licensing fee, but does not have access to personal information of site visitors, spokeswoman Viviana Zanocco said.

Available now: Cannabis Professional, the authoritative e-mail newsletter tailored specifically for professionals in the rapidly evolving cannabis industry. Subscribe now.