The Office of the Privacy Commissioner of Canada (OPC) just published the results of an 18-month investigation into Bell’s Relevant Ads Program (RAP), which involves advertising that is behaviourally targeted to wireless customers. Bell’s announcement of the Program back in August 2013 resulted in 170 complaints to the OPC.
Bell’s RAP uses wireless customer activities (such web pages visited from a mobile device), and account/demographic information (e.g., postal code, gender, age range, and payment patterns) to create user profiles. Advertisers then deliver ads to mobile devices on the Bell network that are targeted based on those user profiles. Although the Program is only for wireless customers, Bell indicated that it intends expand to residential customers in the future.
This is the most comprehensive finding yet involving online behavioural advertising (OBA), and is notable for a number of reasons. Most significantly, the OPC concluded that because the RAP involves the use of “sensitive” information, Bell cannot rely on opt-out consent, according to the OPC’s 2012 Policy Position on Online Behavioural Advertising. It appears that since the OPC finalized its report of finding Bell has agreed to move to an opt-in model, avoiding a potential Federal Court case.
The OPC considers the personal information used by Bell to be sensitive primarily because Bell collects and retains all URLs viewed by a user on their mobile device. That Bell only generates non-sensitive interest categories does not change the fact that the underlying URLs may be sensitive.
The breadth and volume of customer data available to Bell are also relevant factors. According to the OPC,
Bell is able to track every website its customers visit, every app they use – and in the future, potentially every TV show they watch and every call they make – using Bell’s network, whether at home or abroad. Under the RAP, Bell can use this information to infer a wide range of both general and specific interests. The combination of this information with the extensive account/demographic information (e.g., age range, gender, average revenue per user, preferred language and postal code) used by Bell for the RAP will result in highly detailed and rich multi-dimensional profiles that, in our view, individuals are likely to consider quite sensitive.
The OPC also highlighted the fact that Bell seeks to generate additional revenue by tracking and targeting ads to paying customers. The OPC believes users may expect to be tracked in return for a free service, but not so when the service is paid for. This could be the most important factor in distinguishing the RAP from targeting that occurs on sites such as Facebook, which can also involve a lot of detailed personal information (recall that Facebook relies on opt-out consent, and, for some ads, does not even provide an opt-out).
Also interesting is that Bell conducted a survey to support its position on opt out consent. The OPC was not swayed, having hired a professional to evaluate the survey who stated that “most of the conclusions drawn by Bell from the survey are not scientifically supported”. The OPC and Bell even disagreed on whether 170 constitutes a significant number of complaints; while Bell stated that the number represents a small proportion of affected customers, the OPC responded that “never before have so many Canadians taken the time to submit formal complaints to our Office on a specific issue.”
The findings in this case appear to build on rather than alter the framework laid out in the OPC’s 2012 Policy Position by adding to the list of factors that may require opt-in consent for OBA activities. This is in addition to the OPC’s finding last year that creating a profile based on a medical condition (sleep apnea) involves sensitive personal information.