How Free is “Free”? Setting limits on the collection of personal information for online behavioural advertising

An analysis of the privacy protection policies of the major free internet service providers in Canada reveals that these companies collect a stupefying quantity of data on their users, and can attach a considerable number of tags to each user profile. These policies impose very few limits on the companies concerning the use of users’ personal information for advertising purposes.

The Canadian consumers in our focus groups stated that they were surprised at the extent of the collection and use of their personal information for the purposes of OBA. In general, they said that the closer the information gets to their sphere of privacy, the less want it to be used for OBA purposes. They also expressed a desire to be better informed about OBA and to be able give or withhold their consent to it.

Contrary to what the providers suggest in certain of the policies analyzed, most of the data collected on Internet users for OBA purposes would in fact be considered personal information in the eyes of the law. Although this personal information constitutes a medium of exchange that allows consumers to access services online without charge, there is a marked discrepancy between the companies’ legal obligation to collect only as much personal information as they need for the purposes they state and the almost unlimited amount of data they actually do collect. Also, given the insufficiency of the information disclosed and the shortcomings of the available opting-out mechanisms, it is doubtful that the consent obtained from consumers could ever be truly informed.

Although the law does not define fixed categories of personal information whose collection or use is prohibited for the purposes of OBA, it does stipulate higher requirements of consent for what it considers to be sensitive personal information. While the law adopts a contextual definition of sensitivity of information, the companies, which operate in a virtual context, have themselves decided which categories of personal information they consider sensitive. Consequently, interpretations may vary substantially from one company to another. In addition, many companies do not seem to consider certain types of information, such as geolocation and the contents of personal correspondence, to be sensitive at all.

In order to provide companies with better guidance, Option consommateurs recommends in particular that guidelines be adopted that explicitly designate certain categories of personal information as sensitive, without limiting the scope and flexibility of the law. To ensure that consumers are able to consent to OBA in an informed manner, Option consommateurs also recommends that simple, effective and harmonized mechanisms be set in place to allow consumers to give informed, active consent to the collection of their personal information for the purposes of OBA.