January 20, 2012
With the holidays behind us, businesses are particularly interested in their consumers’ online shopping and browsing behaviours so that future advertising can be appropriately tailored for and targeted to them. The tracking of this type of activity is known as “online behavioural advertising”, and the Office of the Privacy Commissioner of Canada recently published guidelines with respect to this conduct and the privacy law implications associated with it.
Privacy law is relevant to online behavioural advertising because it represents a means by which retailers can connect a consumer’s personal information to their online browsing, and that triggers an obligation on the part of the tracker to make sure they obtain the consumer’s consent before collecting this personal information.
The Privacy Commissioner’s guidelines do provide that obtaining “opt-out” consent from the individual, as opposed to “opt-in” which can be more difficult to achieve, is permissible so long as a number of conditions are met by the retailer.
In particular, the existence of online behavioural advertising must be made known in a clear and transparent manner to the consumer and, accordingly, retailers should consider the use of online banners or other methods to communicate their activities. Further, the tracking of online activities of children should be avoided by retailers engaging in online behavioural advertising.
Any opt-out mechanism should be easy to access and should be available at or before the time the consumer’s personal information is obtained, and the opt-out should be activated at once.
It is also critical that consumers be informed of the purpose of the information collection at or before the time their personal information is collected by the retailer, and the collective of sensitive information (such as anything related to health) should be avoided entirely.