The Globe and Mail reported a couple of weeks ago that the Office of the Privacy Commissioner of Canada (OPC) plans to study online behavioural advertising (OBA). The article followed a letter that the OPC sent to notify the Interactive Advertising Bureau (IAB) of the study.
This will likely resemble the mobile app sweep the OPC did last year, and the internet sweep (which examined privacy policies) the year before that. In both cases the OPC took the opportunity to call out good and bad practices among organizations. In what appears to now be an annual tradition, OBA is an obvious next issue: it is widespread and vital to the internet, yet, aside from the Policy Position on OBA published in June 2012, there has been minimal guidance on OBA so far.
So what exactly is the OPC looking for? The OPC stated that “the methodology used in the project would be similar to that used for the investigation of Google’s advertising for health related services” (for those who do not recall, the OPC found that Google violated PIPEDA by allowing advertisers to target internet users who suffer from sleep apnea).
The OPC also stated that the objective is to raise awareness about transparency and providing the ability to opt out of OBA, and that the study will look at “web sites popular in Canada and will not be focusing on particular publishers or advertising organizations.”
Based on this, it would seem that the OPC will look at websites that display targeted ads in order to evaluate whether adequate notice and opt out are provided. This would include, for example, reviewing privacy policies for information about OBA-related activities, and making note of whether ads display the “Ad Choices” icon.
In addition, the OPC will likely look for ads that appear to be targeted based on “sensitive” categories of personal information, like health/medical conditions, race/ethnicity, and possibly financial information.
The study will take place over the next few months, with the results to be released some time in the Spring. The OPC will wait to see the results before it decides whether to publicly name organizations. For anyone who has been meaning to get around to reviewing OBA programs for compliance with PIPEDA, now is the time. Otherwise you you could be the OPC’s next example of what not to do.