Advertisers must let consumers skip online tracking

Consumers should always be able to opt out of online tracking used by companies to provide them with targeted advertising, Canada's privacy commissioner said Tuesday.

Companies such as Googleare increasingly tracking the behaviour ofweb users in order to make their ads more relevant totheir interests.

Privacy Commissioner Jennifer Stoddart said her office recently learned that credit card company Visa has taken out patents to market its transaction information for targeted advertising by combining it with information from social networks, credit bureaus, search engines andonline wish lists.

"Some people like receiving ads targeted to their specific interests.Others are extremely uncomfortable with the notion of their online activities being tracked.Peoples choices must be respected," said Stoddart in a statement while releasing new guidelines on online behavioural advertising at the Marketing and Law conference in Toronto.

Stoddart said the use of technologies that track and target ads to certain consumers has risen dramatically.

"And we're concerned that Canadians' privacy rights aren't always being respected."

She cited a recent study by AT & T and Worcester Polytechnic Institute thatdocumented how popular websites have automatically forwardedpersonal information to data tracking aggregators, apparently without meaningful consent of users.

"My office is very concerned about this issue and it's something we're examining closely."

Stoddart saidthe type of information used to track users and target ads could be used to identify someone and can therefore be considered personal information. As such, it is covered under Canadian privacy laws governing such information.

The new guidelines are intended to provide companies with guidance as to how they can comply with the law, she said in an interview.

"We're saying Canadians should be able to understand what personal information is being collected about them, they should be able to consent to it and collecting their personal information should not be a condition of service to a site."

Stoddart suggested that otherkinds of advertising, based on non-personal information such as individual searches rather than online tracking, can also be used on sites that rely on ad revenue.

She added that her office will keep an eye out in coming months to see whether companies are complying with the guidelines: "If we see troubling trends, we willtake enforcement action."

Currently, companies are nottransparent enough about their use of behavioural advertising, she said.

"Many Canadians dont know how theyre being trackedand thats no surprise because, in too many cases, they have to dig down to the bottom of a long and legalistic privacy policy to find out."

The new guidelines say:

• Any collection or use of a person's web browsing activity must be done with the person's knowledge and consent.
• Information about tracking and behavioural advertising, including its purpose,should be communicated clearly and not buried in a privacy policy.
• Internet users should be able to easily opt out, ideally before the information is collected.
• Technology that makes it impossible for the user to opt out should be avoided. Examples include zombie cookies, super cookies and device fingerprinting.
• Organizations should avoid tracking children and tracking on websites aimed at children because they cannot provide meaningful consent.
• The information collected should be limited and should never include sensitive information such as thatrelated to health.
• The information or the link between the information and a person's identity should be destroyed as soon as possible.

Stoddart said her office is continuing its research on the use of online behavioural marketing, which is still developing. In fact,she said, in the coming weeks, it will release the results of a 1-yearinvestigation on a social networking site targeted at youth with many advertising and tracking features.

Meanwhile, the Interactive Advertising Bureau of Canada is working on a new icon in the shape of an "i" that consumers can look for onparticipating websites and clicklearn what information is being collected by the website.

While the privacy commissioner's guidelines are targeted at advertisers, Stoddart hopesthey will also make internet users more aware so that they will look for information about online tracking and behavioural advertising on the websites of onlineservices they use.

Other countries have also been working on rules and guidelines for online behavioural advertising. For example, the European Union requires internet users to opt in before tracking devices called cookies can be stored in their browser under most circumstances, she said. The U.S. Federal Trade Commission has also been looking into the issue.