Google ads prompted by sensitive personal health information gleaned from users’ online search history violate Canada’s privacy law, the interim privacy commissioner said Wednesday.
Chantal Bernier said an investigation by her department found that Google’s online advertising service used sensitive information from users’ online activities to target them with ads.
The investigation was sparked by a complaint from a man who said he was targeted with ads for products that help sleep apnea after he searched online for medical devices that treat the condition. The man said he noticed the ads as he visited websites that contained information unrelated to sleep apnea.
Bernier said in a statement that her office’s investigation “confirmed the complainant’s experience.”
“The investigation revealed that the complainant visited sites offering information about continuous positive airway pressure (CPAP) machines, which are used during sleep,” the statement read.
“This resulted in a cookie being placed in the complainant’s browser. The cookie ultimately triggered ads for sleep apnea devices to appear on the complainant’s screen when he visited websites that used Google’s advertising services.”
While so-called behavioural ads are not illegal, Canada’s privacy law prohibits advertising that targets consumers based on “sensitive personal information,” including health information.
Bernier said Google has agreed to “take steps” to put a stop to the “privacy-intrusive” ads.
“We are pleased Google is acting to address this problem. Most Canadians consider health information to be extremely sensitive. It is inappropriate for this type of information to be used in online behavioural advertising,” Bernier said in the statement.
“As Canadians spend more and more time online, they create a digital trail that can reveal a great deal about a person. Organizations such as Google must ensure privacy rights are respected in this complex environment.”
Bernier later told CTV’s Power Play that Google did not meet its “duty to be transparent” about the company’s practices as they relate to privacy and personal information.
“The main issue legally is transparency,” she said.
Bernier noted that Google’s own privacy policy states that tailored ads cannot be based on sensitive information related to race, religion, sexual orientation or health, among other categories.
Bernier said her office recommended that Google develop a formal and more thorough process for reviewing its ads to ensure they meet privacy guidelines.
Google has agreed to make several changes, she said, including increasing monitoring of its ad campaigns and improving training for staff to prevent privacy policy violations. It has also agreed to upgrade its automated ad review system.
The company has agreed to implement all of the changes by this June, Bernier said.
Bernier also said that in the wake of the investigation, her office is concerned that other advertising services are flouting Canada’s privacy laws in the same way.
“We will be contacting various advertising stakeholders in the near future to share these investigation results and remind them of their privacy obligations,” Bernier said.
With files from The Canadian Press
