Skip to main content

The Globe and Mail

Google broke Canada’s privacy laws with targeted health ads, watchdog says

The Privacy Commissioner of Canada investigated Google’s practices after receiving a complaint from a man with sleep apnea, which interferes with breathing during sleep.

CHRISTIAN HARTMANN/REUTERS

Canada's federal privacy watchdog has found Google Inc. violated Canadian privacy law through targeted online advertising, a ruling that sends a strong message for the industry to avoid intruding on consumers' personal Internet activity.

The Office of the Privacy Commissioner of Canada on Wednesday made public an investigation that began last year after a man complained about ads targeted to him based on a medical condition. After he searched for a device to help with his sleep apnea, he noticed ads for similar devices when he visited other websites. The ads were delivered by Google's AdSense service.

Now the privacy commissioner is warning the marketing industry it must take greater responsibility in controlling how ads are targeted to people based on personal information revealed through their use of the Web. The privacy commissioner will be taking its message directly to marketers and the companies that operate online advertising networks in the coming weeks and months.

Story continues below advertisement

The ruling highlights the common practice of tracking Internet activity for commercial purposes. It also points to the challenges of determining what constitutes sensitive personal information, and of ensuring companies don't cross the line in their use of it.

According to the watchdog, this problem goes far beyond Google – and more decisions such as this one are likely to come.

"If an organization as sophisticated as Google had difficulty ensuring compliance with its privacy policy, surely others have the same challenges," Interim Privacy Commissioner Chantal Bernier said in an interview Wednesday. "The operational challenges are inherent to online behavioural advertising. There is an ambiguity, and a necessity to define what is sensitive information – and how do you monitor billions of ads?"

Google's privacy policy says the targeted ads it sells on its own search engine, and across the Web through its advertising networks, will not use information such as health, race, religion, or sexual orientation to target ads. The investigation found, however, that Google's enforcement of those guidelines needs to be strengthened.

The decision strikes at the heart of how advertising is bought and sold in a digital age. The value of ads online and on mobile devices is based on how closely they can target consumers through their interests, needs, purchasing histories and even their location. But questions are being raised about when targeting is useful, and when it's an intrusion.

In recent years there has been a massive increase in the business of real-time, programmatic bidding – in which online ads are bought and sold through trading desks, based on the audience those ads will reach. That entire system is built on tracking and behavioural targeting – getting to know who Internet users are based on their Web browsing history, and delivering ads to them based on the profile that behaviour represents.

Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) specifies that targeted advertising must avoid using sensitive personal data – such as information about a person's health. The privacy commissioner's investigation confirmed this type of targeting based on sensitive health information did occur, and found that Google was responsible.

Story continues below advertisement

Google declined a request for an interview Wednesday. In a statement, a Google spokesperson said: "We've worked closely with the Office of the Privacy Commission throughout this process and are pleased to have resolved this issue."

"One thing that is particularly significant is the finding that Google has to specifically ask to track these kinds of behaviours," said Dan Glover, an intellectual property and technology lawyer and partner at McCarthy Tétrault LLP. "It appears not to be enough just to have a terms of use or a privacy policy that buries this kind of detail somewhere. There needs to be a more pro-active way to get express consent to serve ads to people that touch on a sensitive area."

The industry has begun providing more information about targeted advertising and making it easier to opt out through its "AdChoices" program.

In response to the decision on Wednesday, the Interactive Advertising Bureau of Canada issued a newsletter to its members reminding them of that program and encouraging them to take part.

Consumers' ability to control behavioural advertising is limited: They can clear their browser histories, and even clear cookies, and still find they are targeted. "Super cookies" and "zombie cookies" that revive themselves and help advertisers target even conscientious Web users have been the basis for many complaints around the world, Mr. Glover said.

The Privacy Commissioner will be encouraging more companies to address these concerns.

Story continues below advertisement

"There are compliance challenges; they need to have the mechanisms that are up to the task," Ms. Bernier said. "… We're going industry wide."

Google Inc. broke Canada's privacy law by using sensitive information about users' online activities to target them with health-related ads, the country's interim privacy commissioner said Wednesday.

The Privacy Commissioner of Canada investigated Google's practices after receiving a complaint from a man with sleep apnea, which interferes with breathing during sleep.

After searching online for medical devices to treat sleep apnea, the man was shocked to discover he was being pitched devices for the condition when he visited websites that had no relation to the sleep disorder, the commissioner said on Wednesday.

Canada's privacy law forbids the targeting of consumers using "sensitive personal information."

Read the full story.

Here's how Google's ad targeting works.

Report an error Licensing Options
Comments

The Globe invites you to share your views. Please stay on topic and be respectful to everyone. For more information on our commenting policies and how our community-based moderation works, please read our Community Guidelines and our Terms and Conditions.

We’ve made some technical updates to our commenting software. If you are experiencing any issues posting comments, simply log out and log back in.

Discussion loading… ✨

Combined Shape Created with Sketch.

Combined Shape Created with Sketch.

Thank you!

You are now subscribed to the newsletter at

You can unsubscribe from this newsletter or Globe promotions at any time by clicking the link at the bottom of the newsletter, or by emailing us at privacy@globeandmail.com.