Google has agreed to several concessions after an investigation by Canada’s Office of the Privacy Commissioner found Google in violation of Canada’s privacy rights for the use of sensitive health history in remarketing campaigns.
The investigation began last January, when a man complained that his personal health history was being used for ad targeting purposes. After searching for and visiting sites related to medical devices for sleep apnea, he was retargeted with display ads for those devices when he browsed the web.
The Commissioner’s office has agreed with the man that Google unlawfully used sensitive health information for ad targeting purposes. It is inappropriate for this type of information to be used in online behavioural advertising,” says Interim Privacy Commissioner Chantal Bernier. Adding, “As Canadians spend more and more time online, they create a digital trail that can reveal a great deal about a person. Organizations such as Google must ensure privacy rights are respected in this complex environment.”
Two years ago the Office of the Privacy Commissioner issued guidelines around online behavioral advertising (OBA) as it relates to the Personal Information and Electronic Documents Act (PIPEDA). Ad targeting based on health, financial information or other interests that are considered “sensitive” is prohibited.
Google’s own privacy policy states it “will not associate sensitive interest categories with your cookie (such as those based on race, religion, sexual orientation, health, or sensitive financial categories) and will not use these categories when showing you interest-based ads”.
In its response to the Commissioner’s office during the inquiry Google blamed advertisers for not following the policies,
Google also provided detailed information on how it monitors ads and advertisers to prevent abuses. Canada’s privacy office found the monitoring tools “were not scalable and had demonstrable shortcomings,” and made recommendations for developing a “more formalized and rigorous system for reviewing advertisements and addressing instances of non-compliance.”
As a result, Google said it will upgrade its automated review systems by June 2014.
Additionally, Google says it has rejected all active retargeting campaigns involving CPAP devices and has increased searches of active retargeting campaigns potentially related to sensitive interest categories.
The move will likely impact a wide swath of advertisers running retargeting campaigns. Steve Cameron of Advent Communications in the UK discovered that Google deactivated remarketing lists for a cancer facility client in which members of the lists were located in Canada as a result of the ruling.
It remains unclear if Google will adopt this new level of stringency across the board when it revamps its automated ad review platform.
Meanwhile, Canada isn’t stopping with Google. Interim Privacy Commissioner Chantal Bernier added in a statement, “We also have concerns about whether other advertising networks are complying with Canadian privacy law. We will be contacting various advertising stakeholders in the near future to share these investigation results and remind them of their privacy obligations.”
Contributing authors are invited to create content for Search Engine Land and are chosen for their expertise and contribution to the search community. Our contributors work under the oversight of the editorial staff and contributions are checked for quality and relevance to our readers. The opinions they express are their own.
