Google has agreed to several concessions after an investigation by Canada’s Office of the Privacy Commissioner found Google in violation of Canada’s privacy rights for the use of sensitive health history in remarketing campaigns.
The investigation began last January, when a man complained that his personal health history was being used for ad targeting purposes. After searching for and visiting sites related to medical devices for sleep apnea, he was retargeted with display ads for those devices when he browsed the web.
The Commissioner’s office has agreed with the man that Google unlawfully used sensitive health information for ad targeting purposes. It is inappropriate for this type of information to be used in online behavioural advertising,” says Interim Privacy Commissioner Chantal Bernier. Adding, “As Canadians spend more and more time online, they create a digital trail that can reveal a great deal about a person. Organizations such as Google must ensure privacy rights are respected in this complex environment.”
Two years ago the Office of the Privacy Commissioner issued guidelines around online behavioral advertising (OBA) as it relates to the Personal Information and Electronic Documents Act (PIPEDA). Ad targeting based on health, financial information or other interests that are considered “sensitive” is prohibited.
In its response to the Commissioner’s office during the inquiry Google blamed advertisers for not following the policies,
Google stated that remarketing criteria and user lists are determined by the advertiser directly. Google requires all advertisers using this platform to agree to specific policies, which prohibit all forms of interest based advertising involving sensitive categories, including the use of user lists based on “health or medical information”. According to Google, it is up to each remarketer to determine the application of Google’s policies to any proposed remarketing. Google indicated that, despite its policies and guidance, certain advertisers or third party buyers can use remarketing products in error.
Google also provided detailed information on how it monitors ads and advertisers to prevent abuses. Canada’s privacy office found the monitoring tools “were not scalable and had demonstrable shortcomings,” and made recommendations for developing a “more formalized and rigorous system for reviewing advertisements and addressing instances of non-compliance.”
As a result, Google said it will upgrade its automated review systems by June 2014.
Additionally, Google says it has rejected all active retargeting campaigns involving CPAP devices and has increased searches of active retargeting campaigns potentially related to sensitive interest categories.
The move will likely impact a wide swath of advertisers running retargeting campaigns. Steve Cameron of Advent Communications in the UK discovered that Google deactivated remarketing lists for a cancer facility client in which members of the lists were located in Canada as a result of the ruling.
It remains unclear if Google will adopt this new level of stringency across the board when it revamps its automated ad review platform.
Meanwhile, Canada isn’t stopping with Google. Interim Privacy Commissioner Chantal Bernier added in a statement, “We also have concerns about whether other advertising networks are complying with Canadian privacy law. We will be contacting various advertising stakeholders in the near future to share these investigation results and remind them of their privacy obligations.”