Google, Facebook, Yahoo!, YouTube... most of the sites that Internet users visit every day don't charge their users a penny. These no-fee service providers finance their activities through online behavioral advertising (OBA), a form of advertising in which a user's browsing activities are used to build a profile of him or her and display corresponding ads on the sites he or she visits.
An analysis of the privacy policies of Canada's largest toll-free Internet service providers reveals that they collect a staggering amount of data on their users, and can assign a considerable number of labels to an Internet user's profile. These policies place very few limits on how companies can use Internet users' personal information for advertising purposes.
In focus groups, Canadian consumers expressed surprise at the extent to which their personal information is collected and used for SCP. Generally speaking, they said that the closer a piece of information is to their private sphere, the less they want it to be used for SCP purposes. They also expressed the wish to be better informed about PCL and to be able to give valid consent.
Contrary to what some of the policies analyzed suggest, the data collected on Internet users as part of the PCL will generally be considered personal information within the meaning of the law. While this personal information constitutes a bargaining chip enabling consumers to access services free of charge online, there is a certain discrepancy between companies' legal obligation to collect only the personal information necessary for the purposes they state, and the almost limitless amount of data they claim to collect. Similarly, given the gaps in the information disclosed and the shortcomings of the opt-out mechanisms available, it is doubtful whether the consent obtained from consumers is truly informed.
While the law does not establish fixed categories of personal information whose collection or use would be prohibited under the PCL, it does provide for higher consent requirements for personal information that qualifies as sensitive. While the law adopts a contextual definition of the sensitivity of information, in the virtual context, companies themselves determine the categories of personal information they consider sensitive. As a result, interpretations can vary from one company to another. What's more, many companies don't seem to consider certain types of sensitive information, such as geolocation and the content of private correspondence, to be sensitive a priori.
To better guide businesses, Option consommateurs recommends, among other things, the adoption of guidelines explicitly designating categories of personal information as sensitive, without limiting the scope and flexibility of the law. To ensure that consumers give their informed consent to PCL, Option consommateurs recommends, among other things, implementing simple, effective and harmonized mechanisms enabling consumers to validly and actively consent to the collection of their personal information under PCL.
