The Office of the Privacy Commissioner of Canada (OPC) has published a new report on how Canadian advertisers are using behavioural retargeting, and how well they’ve been complying with federal regulations about data collection by private companies. The OPC’s researchers found that for the most part, Canadian advertisers are providing the required opt-out information to consumers — but that behavioural advertising is not very common anyway.
Privacy Commissioner Daniel Therrien
For each testing run, the simulated consumer would look up one of 12 interest topics, like “European travel,” or “divorce lawyer,” and click on the first 35 search results it saw, to build up a browser activity history that would look attractive to a retargeting algorithm. The majority of the topics chosen were considered “sensitive” by the OPC, including “depression cures,” “liposuction,” and “pregancy test,” though five typical consumer searches were included as well.
Once the test consumer had established their “interest,” they then visited 46 of Canada’s top publisher sites as ranked by Alexa (a list that includes Red Flag Deals, Sportsnet and Business Insider, among others), and recorded whether an ad was shown that matched the simulated interest.
Of 9,000 ads that were reviewed, only 300, or 3%, matched the interest topic. Perhaps more tellingly, only about half of the sites visited (52%) had any retargeted ads for any of the searched topics.
The report notes that its results were likely limited by the simplicity of the method used to simulate interest. The sample was also likely limited by the use of sensitive search terms.
Opt-outs widespread, but poorly implemented
The report’s main focus was on the implementation of privacy opt-outs that were compliant with the federal Personal Information Protection and Electronic Documents Act. PIPEDA requires that consumers be made aware of when data is being collected about them or used to target them, and that they be given the opportunity to opt out.
Nearly all (96.3%) of the behaviourally retargeted ads the OPC reviewed complied with the law, using AdChoices or another opt-out.
But the bigger problem was a lack of consistency in what happened after a visitor clicked the AdChoices icon — the actual opt-out process. Some providers, like Truste and Chango, offered clear instructions and opt-out options, while others had “unclear information and cumbersome procedures,” the report says. It called out Adobe and Amazon for not using the term “opt-out” or clearly identifying where on the page the option was, and was especially critical of Google, which in some cases required the user to click through four screens before actually seeing opt-out options.
“Where targeted ads appeared, we found that the procedures for opting out of OBA were often unsatisfactory,” the report concluded.
The OPC stressed that the report was a data-gathering exercise, not an investigation or attempt to identify non-compliant organizations.
