Canada’s Privacy Commissioner said last week (15 January 2014) that ads by Google prompted by sensitive personal health information collected from users’ online search historyviolate Canada’s privacy law.
According to the Commissioner, an investigation by the Privacy Department found that Google’s online advertising service used sensitive information from users’ online activities to target them with ads. The investigation was sparked by a complaint from a man who said he was targeted with ads for products that help sleep apnea after he searched online for medical devices that treat the condition. The Commissioner announced that the investigation against Google revealed that the complainant visited sites offering information about continuous positive airway pressure machines, which are used during sleep, and this resulted in a cookie being placed in the complainant’s browser. The cookie ultimately triggered ads for sleep apnea devices to appear on the complainant’s screen when he visited websites that used Google’s advertising service.
As opposed to the general case in which behavioral ads based on personal information are being placed in compliance with the law, Canada’s privacy law prohibits advertising that targets consumers based on “sensitive personal information,” including health information.
Following the investigation, Google agreed to make several changes, including increasing monitoring of its ad campaigns and improving training for staff to prevent privacy policy violations. It has also agreed to upgrade its automated ad review system.
This case stresses the importance of distinguishing between advertising based on “regular” personal browsing behavior, and advertising that is based on sensitive personal information - which may be prohibited and violate the privacy of users.