Cookies

In Canada, the use of website-based tracking technologies is subject to Canadian private sector privacy laws, to the extent that they may be considered to be “personal information” under applicable laws.

The term “personal information” is broadly defined to mean any information about an identifiable individual and has been interpreted to include any information through which there exists a serious possibility that an individual could be identified through the use of that information, either alone or in combination with other information.  Based on these interpretations various Canadian privacy commissioners take the view that tracking technologies, including cookies, that are tied to IP addresses or persistent device identifiers will generally be considered to be “personal information”, which makes the use of such technologies subject to privacy laws.

 

In general, websites should inform users if cookies are used by the website and the purposes for which the information will be used. Part of this notification is typically done in the website’s privacy policy, a link to which should be posted on every page where user information is collected.  However, with increasing frequency, websites in Canada are providing banner and pop-up notices to draw attention to the use of cookies and other tracking technologies, and many sites have created separate cookie policies, also posted to the website, to explain the technologies involved and outline their uses.

 

Under Canadian private sector privacy laws, an organization cannot, as a condition of the provision of a product or service, require the collection, use or disclosure of personal information for purposes not strictly required to provide that product or service.  For any “secondary” purposes, an opt-out option must be provided, or express consent collected.  Accordingly, privacy commissioner guidance requires an easy-to-use opt out for the use of personal information in interest-based advertising.  Browser controls for “ordinary” cookies are a generally accepted means of opt-out control; however, the Privacy Commissioner of Canada, for one, has voiced significant concerns with respect to other forms of cookies or web tracking technologies that do not enable users to readily opt-out or otherwise control such technologies, such as so-called “zombie” cookies, super cookies or device fingerprinting.

Canadian privacy laws impose higher standards for consent and handling of more sensitive types of personal information, such as financial or health information, or information about children.  Privacy commissioner decisions have generally found that such information should not be used for targeted advertising purposes.

 

The Office of the Privacy Commissioner of Canada has published several documents concerning the use of cookies and the subject of interested-based advertising in general, including its Policy Position on Online Behavioural Advertising and Guidelines on Privacy and Online Behavioural Advertising, which may be found on the Behavioural/targeted advertising page of the organization’s website.

Please visit: https://www.priv.gc.ca/en/privacy-topics/advertising-and-marketing/behaviouraltargeted-advertising/

 

The Digital Advertising Alliance of Canada (DAAC) is a self-regulatory organization that administers the Ad Choices program, which is designed to give consumers a better understanding of, and greater control over, the ads that are displayed to them based on their online behaviour. This is a useful tool for consumers to opt-out of interest-based advertising.

Please visit: http://youradchoices.ca/