Google Inc. broke Canadian privacy laws by using sensitive information about people’s Internet activities in order to serve them up targeted health-related online advertisements, the privacy commissioner of Canada said Wednesday.
The Office of the Privacy Commissioner of Canada launched an investigation into Google’s online ad practices after receiving a complaint from a man with sleep apnea. Sleep apnea is a type of sleep disorder typified by shallow or disrupted breathing during sleep.
After searching online for medical devices to treat his condition, the complainant was shocked to be suddenly “followed” by advertisements for such devices as he visited Web sites completely unrelated to sleep disorder.
Investigators for the commissioner’s office conducted Web search tests and found “ads for medical devices were displayed on test sites about unrelated issues such as news and weather.”
Investigators said that when the complainant visited sites offering information on continuous positive airway pressure devices, a digital cookie would be inserted onto the complainant’s device. The cookie triggered ads for sleep apnea devices to appear on the complainant’s screen when he visited Web sites that used Google’s advertising services.
“It is inappropriate for this type of information to be used in online behavioural advertising,” said interim Privacy Commissioner Chantal Bernier, in statement. “As Canadians spend more and more time online, they create a digital trail that can reveal a great deal about a person. Organizations such as Google must ensure privacy rights are respected in this complex environment.”
The statement said that Google “has agreed to take steps aimed at stopping the privacy intrusive ads.”
Online behavioural advertising guidelines issued the Privacy Commissioner’s Office in 2012 states that advertisers should avoid collecting sensitive personal information, such as individual’s health information, for the purpose of delivering targeted ads.
Google’s own privacy policy, according to the privacy watchdog, states that the company will not associate cookies or other identifiers with information such as an individual’s race, religion, sexual orientation or health.
The commissioner’s office said Google said the problem addressed in the investigation stemmed from what it called a“remarketing campaign.” This type of campaign allows advertisers to target ads to recent visitors to their site.
“Google acknowledged that some of the advertisers using its ad service do not comply with the corporation’s policy against interest-based advertising related to sensitive issues,” the government body said.
Google has agreed to fully implement by 2014 the following recommendations by the privacy commissioner’s office:
- Provide additional information to advertisers creating campaigns
- Increase monitoring of the remarketing campaign for possible policy violations
- Offer more training to its own staff in addressing potential policy violations
- Upgrade its automated review system