Following an investigation by the Privacy Commissioner of Canada into an advertising program that uses customer data to deliver highly targeted advertising, Bell will comply with the recommendation for a more transparent opt-in approach – but it wants Facebook and Google to do the same.
After what the Office of the Privacy Commissioner (OPC) described as an “unprecedented” 170 complaints under the Personal Information Protection and Electronic Documents Act (PIPEDA), it launched an investigation into Bell’s Relevant Advertising Program. The program involves tracking the Internet browsing habits and app usage of customers, as well as TV viewing and calling patterns, and combining that with demographic and account data to allow third parties to pay Bell to deliver highly targeted ads to Bell customers. Bell’s mobile, home phone, Internet and TV services are all covered by the program.
When the OPC released its report Tuesday morning, it said while Bell had agreed to comply with the bulk of its recommendations regarding the program, the opt-in mechanism remained a sticking point. OPC wanted Bell to require customers to agree to opt-in to the program, while Bell felt an opt-out approach was sufficient.
According to the OPC report, the information collected by Bell could include every website its customers visit, every app they use, every TV show they watch and every call they make using Bell’s network.
“Bell’s ad program involves the use of vast amounts of its customers’ personal information, some of it highly sensitive,” said privacy commissioner Daniel Therrien, in a statement. “Bell should not simply assume that, unless they proactively speak up to the contrary, customers are consenting to have their personal information used in this new way.”
Later in the day though Bell changed course, and agreed to shift to an opt-in mechanism for the advertising program.
“Bell will abide by the privacy commission’s decision including the opt-in approach. We’re dedicated to protecting customer privacy and thank the commission for clarifying the rules,” said Bell spokesperson Jason Laszlo in a statement provided to ITBusiness.ca. “These are rules that must apply not only to Canadian companies but to international companies operating here, like Facebook and Google, to ensure a fair and competitive marketplace.”
The OPC did acknowledge that behaviourally targeted advertising is an emerging business trend that is not unique to Bell, and will be more closely scrutinized by the OPC in the future.
“This is not something exclusive to Bell,” said Therrien. “We will be reaching out to other organizations that are engaged in or considering this type of activity, including the wider telecommunications sector, as we believe others could benefit from our findings in this investigation.”
When reached for comment Tuesday afternoon, a spokesperson for the OPC said it will withhold comment until it receives word of Bell’s about-face from Bell directly.
“To date Bell has indicated to us that it would not implement our recommendation with respect to opt-in consent,” said OPC spokesperson Tobi Cohen told ITBusiness.ca. “We will be meeting with Bell tomorrow and will wait to hear directly from the company before commenting on whether the company is indeed reversing its position.
As far as Bell’s comments regarding Facebook and Google, Cohen said OPC’s investigation was focused on Bell and each investigation must be determined on its own unique facts, so it’s not in a position to comment on programs it hasn’t examined. However, all organizations are subject to PIPEDA’s requirements.
“If other organizations are engaged in targeted advertising programs that are materially similar to Bell’s, then we would expect that they too obtain express, opt-in, consent,” said Cohen.
Bell’s decision to abide by the opt-in requirement was also news to John Lawford, executive director of the Public Interest Advocacy Centre (PIAC) in Ottawa. The organization filed one of the complaints received by the OPC over the Bell program, and it welcomed today’s findings by the OPC of serious privacy concerns with the advertising program.
Lawford said he is pleased Bell will abide by the opt-in requirement, as long as any data that was collected before this date with only implicit consent is excluded from the program.
“Saying you won’t do it in the future doesn’t really solve the problem,” said Lawford.
And the consent issue is really only part of the problem, added Lawford. The CRTC is also investigating the Bell program, and PIAD contends in its complaint that it’s unlikely the telecommunications act under which Bell operates and collects subscriber data allows it to be used for advertising purposes – even with implicit consent.
“They’re trying to leverage the information they gain as being a telecom provider and reuse it to tailor ad serving, and it’s an open question if telecom law allows that,” said Lawford. “We say no, as telecom law is very careful about not revealing any customer information.”
Lawford added that Bell’s comment about Facebook and Google are a red herring, as those companies aren’t telcos. If Bell wanted to start its own separate advertising company that would be another matter, but it wouldn’t have access to subscriber data.
The CRTC could issue its own ruling on the Bell advertising program as soon as next month.
Other OPC recommendations that Bell immediately agreed to included adding language to Bell’s agreement with advertisers to prohibit them from using cookies or other tools to link data obtained by Bell to an actual Bell customer, not share credit score information in customer profiles, only use partial postal codes for targeted ad delivery, and remove Bell-owned retail electronics store The Source from Bell affiliates that can gain access to information associated with the program.