Targeted Advertising and the “Reasonable Expectations” of Customers

Éloïse Gratton June 2, 2015

An article was published yesterday which pertains to Netflix testing ads surrounding its shows. An update was then posted beside the title of the article to specify: “only its own” to refer to the fact that Netflix would be testing ads to promote its own products and not enabling third party ads. This brings forward the issue of whether the use of personal information for the purpose of providing targeted advertising is an acceptable purpose under privacy laws, and what type of consent should be required for an organization to be able to provide targeted advertising to its customers about its own products.

In Canada, PIPEDA sets out ground rules for how private sector federal works, undertakings and businesses collect, use and disclose personal information about their customers, unless such activities are regulated by provincial legislation that has been declared substantially similar to PIPEDA. PIPEDA is based on flexible principles (or “soft law”), which were meant to be technology neutral and be easily adapted to new types of technologies. As a matter of fact, the fundamental principles of PIPEDA are found in its Schedule 1. Schedule 1 is based on the Canadian Standards Association’s Model Code for the Protection of Personal Information, which, in turn, incorporates the Fair Information Practices.

PIPEDA provides a “reasonableness” test (s. 5 (3) under which “an organization may collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances”, which is quite subjective in nature. Under these privacy /data protection laws (PIPEDA, and substantially similar provincial laws), consent would be required prior to collecting personal information. The form of the consent sought by the organization may vary, depending upon the circumstances, the type of information and the sensitivity of the information. Under PIPEDA, in obtaining consent, the “reasonable expectations” of the individual are also relevant. This translates into the fact that it is sometimes quite a challenge for organizations to determine how to comply with PIPEDA when undertaking innovative marketing initiatives. So far, only a few findings have been issued by the Office of the Privacy Commissioner (OPC), which are relevant on the issue of OBA, targeted advertising and privacy.

Targeted Advertising as a Reasonable Purpose

A recent decision was issued in April 2015 and involved a telecommunications service provider’s Relevant Advertising Program (“RAP”). The OPC recognized in this decision the organization’s valid business objective to generate increased advertising revenue, and determined that the RAP did not represent a use of customers’ personal information for an “inappropriate purpose”.

Consent and the “Reasonable Expectations” of Customers

On the consent issue, the OPC found in this recent RAP decision that express (opt-in) consent was required (and that an opt-out type of consent was inadequate), given that following two principle factors:

  • Sensitivity of Information: The fact that the RAP was using sensitive URLs for the purpose of generating customer profiles was taken into account. In the OPC’s view, the sheer breadth of information being used or contemplated for the RAP (including internet, telephone and television network usage information, as well as account/demographic information) rendered such information more sensitive when compiled.
  • Reasonable Expectations of Customers: The OPC determined that customers would reasonably expect their telco to obtain opt-in consent in light of all the contextual factors surrounding the RAP, when considered in combination and in concert with each other. More specifically, the OPC considered that the telco: (i) began using information it already collected for the purposes of delivering its primary services for the new secondary purpose of delivering behaviorally targeted ads; (ii) delivers paid services, for which customers may pay up to hundreds of dollars per month; (iii) was enabling the delivery of third-party ads; and (iv) is a telecommunications service provider to whom users must entrust vast amounts of their sensitive personal information in order to gain access to mobile, internet, telephone and television communications in Canada.

This decision raises interesting issues and concerns. First, it is sometimes a challenge to determine what type of information should be considered as sensitive information. PIPEDA provides little guidance on this issue ( “any information can be sensitive, depending on the context” s. 4.3.4 PIPEDA). Will a provider of on-demand Internet streaming media delivering targeted advertisement may be considered as using sensitive information? Potentially, if we consider that certain categories of shows may be more sensitive than others, for instance shows promoting violent, horror or adult content, or disclosing the personal interests of the individual (sexual orientation, religion, etc.)

Second, this decision may potentially be relevant for any other type of service provider to whom users must entrust vast amounts of their sensitive personal information, such as health or financial information.

Third, the OPC in this decision determined that customers would reasonably expect their telco to obtain opt-in consent in light of all the contextual factors surrounding the RAP. It is yet to be determined if a similar decision would have been reached by the OPC on the consent issue if the organization was not enabling the delivery of third party advertising, but was instead promoting its own products.

This content has been updated on June 2, 2015 at 20 h 09 min.