Don’t use Web bugs, zombie cookies, pixel hacks and the like. Individuals must be informed if their personal information is being collected or their online behaviour is being tracked. And above all, keep your tracking technologies away from children.
These were some of the points of new guidelines on online advertising unveiled today before marketing professionals by Canada’s Privacy Commissioner Jennifer Stoddart. Speaking at an Association of Canadian Advertisers (ACA) titled Marketing and the Law, Stoddart said her office understands that online behavioural advertising (OBA) is “vital” for many businesses, especially those with an online presence.
“There are people that like online tracking because it facilitates targeted ads, which they welcome,” said Stoddart. “But there are also people who find the practice of their online activities being tracked downright creepy.”
Stoddart said it has been more than 10 years now since concerns over OBA were first raised “Yet, up to today the top complaints we receive from consumers involve unauthorized collection of personal data and online activity and the unauthorized use of these by third parties.”
However, she said OBA may be considered a reasonable purpose under the Personal Information Protection and Electronic Document (PIPEDA), as long as it is carried out under certain parameters. The main thing, the commissioner said, is that individuals are aware that data collection is taking place; the purpose for which information in being collected; and that individuals are given a means to refuse the collection.
“That means no use of Web bugs or Web beacons, no super cookies, no pixel hacks, no device fingerprinting and no to any new covert tracking technique of which the user is unaware and has no reasonable way to decline,” Stoddart said.
The commissioner said businesses that fail to comply could face disciplinary measures.
“We have the powers to investigate businesses and conduct an audit. We can go to the federal courts to compel organizations to comply or fine them and we can publicly name erring businesses,” Stoddart said.
The new guidelines include:
- Individuals must be made aware of the purposes behind the collection of data and tracking of their online activities. This warning must be made obvious, easily accessible and understood.
- People must be made aware of the data collection before the time of collection. Individuals must also be told of the various parties involved in the OBA.
- An opt-out mechanism must be made available to individuals, ideally before the data collection begins. The opt-out should take effect immediately and persistently.
- Technology that makes it impossible to opt-out should not be used.
- Opting-in should not be used as a condition for accessing service.
- Information collected should be limited and must not include sensitive personal information.
- Information or links between information and a person’s identity should be destroyed as soon as possible.
- Organizations should avoid knowingly tracking children and conducting tracking on Web sites aimed at children.
Stoddart said it is important to take into account that more often than not minors are using the Internet with very little, if any, adult supervision.
“Children are not likely to be able to provide the meaningful consent required under our privacy law for the tracking of their online activities,” she said. “This is an increasingly important issue as we see the average age of first-time Internet users dropping.”
Bob Reaume, vice president for policy and research at ACA, said the advertisers’ group was aware of the direction the commissioner was taking even before the announcement.
“I wouldn’t say the announcement was a surprise,” he told ITBusiness.ca.
Reaume said the ACA had been in consultation with the Privacy Commissioner’s office for the past 18 months. “They did not tell us go this way or that, but we certainly got some feedback and in many instances these dovetailed with what our coalition agreed with.”
However, He said there may be some “technical differences” to tackle regarding some points of the guidelines. For example, Reaume said, advertisers might find it hard to determine if online users are consenting adults or minors.
“The thing with the Internet is that you often have no way of knowing who is on the other end,” said the ACA official.
Nestor Arellano is a Senior Writer at ITBusiness.ca. Follow him on Twitter, read his blog, and join the IT Business Facebook Page. 
