Advertisers are tracking your online behaviour

Every Move You Make… Advertisers are tracking your online behaviour. Everything you do online is recorded in some way. And some of this information is increasingly being gathered and used for commercial purposes. Data has become big business.

When you use a computer or a mobile device to go online, your online activities can be observed and tracked by advertising networks to determine certain personal characteristics, preferences and web browsing history. In a practice known as behavioural advertising, the information gleaned from such practices is then used to deliver advertising that is targeted to your inferred interests.

Advertisers use various tracking technologies, such as HTTP cookies, Flash cookies, web beacons and deep packet inspection technology, to collect your online user data. Each of these data-collection methods typically remains invisible to you.

The Office of the Privacy Commissioner of Canada has prepared this fact sheet and some Frequently Asked Questions (FAQs) on behavioural advertising to explain what it is, the privacy challenges it raises and what you can do about it.

Behavioural Advertising

As Canadians embrace social networks and other online technologies, they are sharing increasing amounts of personal information over the Internet. Some of this sharing is done deliberately, by posting pictures and comments. But the mere fact of navigating the Internet also leaves behind a rich trail of information that can reveal a great deal about a person’s location, personal preferences, computer settings and browsing patterns.

Tracking these trails is behavioural advertisers’ bread and butter. The type of information tracked and collected can include: IP addresses, pages visited (on a single site or across sites), length of time spent on pages, advertisements viewed, articles read, purchases made, search terms used, user preferences such as language and web browser type, operating system and geographical location.

Behavioural advertisers can then use sophisticated algorithms to analyze the collected data, to build detailed users’ personal profiles and to assign them to various interest categories. Interest categories are used to present ads defined as relevant to users in those categories. Depending on the advertiser, these interest categories can be broad or very specific.

Although it is often argued that information that can be collected about online activity is anonymous and cannot identify individual users, recent reports have shown that, sometimes, what is assumed to be anonymous data can be re-identified with relative ease. In addition, combining data from “anonymous” online profiles with real-world information from other sources such as social networking sites can increase the risk of anonymous online profiles being tied to offline identities.

The Personal Information Protection and Electronic Documents Act (PIPEDA) applies to the collection, use and disclosure of personal information in the course of a commercial activity. It requires that purposes be “appropriate,” identified to the individual and consent obtained. Instances where consent is not required are limited.

A 2009 survey conducted by the Public Interest Advocacy Centre found that nearly three-quarters of respondents said they were uncomfortable with behavioural advertising, and only about half of respondents were aware of tracking devices and techniques. However, people tended to be more comfortable with online tracking for the purposes of improved customer service or advertising if it was done by companies with which they had had prior dealings.

The Office of the Privacy Commissioner is concerned about the potential privacy infringements presented by such practices, particularly the lack of transparency with which they are conducted and the quality of the consent obtained as a result of these practices. It has called on the advertising industry to better explain what behavioural advertising involves, and how people can opt out if they wish. The industry should also ensure that organizations obtain appropriate consent before tracking consumer.