Tracking changes in the law and best practices for behavioural advertising1 


March 15, 2011

Advertising & Marketing Bulletin
Susanna Kam

World Consumer Rights Day

Behavioural advertising (also called interest-based advertising) is a relatively recent phenomenon that has spawned from developments in internet technology and advertising. Despite its newness, behavioural advertising already accounts for approximately 10% of internet advertising revenues in Canada and has raised issues of how to best regulate this form of advertising. 2

what is behavioural advertising?

According to the Office of the Privacy Commissioner of Canada (the "OPC"), behavioural advertising involves tracking consumers' online activities over time, so that marketers can deliver advertisements that are targeted to individuals' inferred interests. This requires advertisers to collect and retain personally identifiable information of web-users over extended periods of time, in order to generate user profiles and identify specific types of users so that they can offer targeted advertising.

the upside and why advertisers use it

The ability to target specific types of users makes behavioural advertising attractive to marketers since it offers a more cost effective means of reaching out to consumers. In addition, the Internet's network effects help to bring people together and build online communities, which in turn, allow advertising messages to spread more quickly and on a wider scale.

the downside and why some consumers are concerned

The incorporation of increasingly sophisticated forms of technology into behavioural advertising has also drawn considerable criticism. The collection and retention of information raises privacy and security concerns, especially when it comes to the collection of personally identifiable information (e.g., financial, geographical and health or medical information). In addition, there is a considerable lack of consumer education relating to privacy rights and the risks involved in sharing information. These concerns culminate into the issue of valid, meaningful consent as to whether individuals actually comprehend website privacy policies. Notwithstanding, or perhaps because of a lack of knowledge, an overwhelming 90% of Canadians (according to a study commissioned by the OPC) have expressed concern about the impact of new technology. 3

how regulators are responding
In 2009, the OPC launched an investigation of Facebook in response to a complaint that raised issues regarding the knowledge and consent of users and Facebook's methods and policies relating to the retention of personal information. In particular, the OPC took special interest in the allegations concerning behavioural advertising and ordered Facebook to change a number of its privacy policies and the manner in which it obtains user consent. The OPC's Report of Findings on the Facebook complaint resulted in several corrective actions to the Facebook website, but now other features, such as the "like" button are undergoing review by the Canadian Privacy Commissioner.

The risks associated with behavioural advertising have forced regulators to reconsider the adequacy of existing advertising/marketing and Internet privacy laws. After its investigation of Facebook, the OPC held a number of consultations to address the issue of behavioural advertising and produced a draft report on Online Tracking, Profiling and Targeting and Cloud Computing . The draft report follows a FTC report on Self-Regulatory Principles for Online Behavioural Advertising .
applicable Canadian laws and self-regulatory codes

The current applicable laws in Canada include the Competition Act , Personal Information Protection and Electronic Documents Act , and the newly passed Fighting Internet and Wireless Spam Act . 4  In addition, self-regulatory guidelines and principles have been published by industry organizations, such as the Network Advertising Initiative's Self Regulatory Code of Conduct , the World Federation of Advertisers' Global Principles for Self Regulation in Online Behavioural Advertising and the recent additions to the Canadian Marketing Association Code of Ethics regarding online interest-based advertising.

an emerging international approach inspired by Canadian principles?

In other jurisdictions, such as the US and the EU, regulators have also reviewed the law and considered new approaches for regulating behavioural advertising. The European Parliament approved a Resolution 2010/2052(INI) on December 15, 2010, on the impact of advertising on consumer behaviour, which highlighted the intrusiveness of behavioural advertising techniques and called for clear notifications and information to be provided to consumers next to advertisements that use the behavioural advertising technique.  Indeed, starting May 25, 2011, a new European law will require sites to obtain "explicit consent" from users before issuing cookies.  As part of its work to comply with the law, the Internet Advertising Bureau, an industry association, created a site that explains how behavioural advertising works and lets people opt out of it.  In the US, the FTC has published several reports that have proposed different frameworks and principles for online behavioural advertising, including the use of opt-in and opt-out privacy mechanisms and a "do-not track" registry.  Although the FTC has not undertaken any investigations of Facebook, the social networking website has been invited to comment on several of the FTC's reports. These developments are not only important because they help to shape Canadian law, but also since online behavioural advertising practices transcend national borders.

Notably, the Privacy by Design approach, developed by Ontario Information and Privacy Commissioner, Dr. Ann Cavoukian, is a preferred approach in both Canada and the US. This model promotes the use of "privacy as the default setting", which automatically requires personal data to be protected. The "Ontario Two-Step" Process, which is meant to achieve this end goal and is discussed in Dr. Cavoukian's submission to the FTC on its Proposed Framework for the Protection of Consumer Privacy , requires businesses to: 1) present a clear opportunity for consumers to opt-out of being tracked or receiving targeted advertising; and 2) make this choice persistent and global.

Ultimately, the challenge for lawmakers is how to best balance the privacy concerns of individuals, without stifling the general public interest in promoting innovation. Consequently, this common concern has prompted legislators to share ideas and consider new issues, which will no doubt lead innovative solutions for regulating online behavioural advertising. 

By Bill Hearn and Susanna Kam


1. The assistance of Susanna Kam , an articling student at McMillan LLP, in preparing this note is gratefully acknowledged.

2. Consultations on Online Tracking, Profiling and Targeting and Cloud Computing , October 2010 (Ottawa: Office of the Privacy Commissioner of Canada) at 11 [OPC Draft Report 2010].

3. OPC Draft Report 2010 at 13.

4. The Act was formerly known by this title, FISA for short. It is now inelegantly called An Act to promote the efficiency and adaptability of the Canadian economy by regulating certain activities that discourage reliance on electronic means of carrying out commercial activities

  a cautionary note

The foregoing provides only an overview and does not constitute legal advice. Readers are cautioned against making any decisions based on this material alone. Rather, specific legal advice should be obtained.

© McMillan LLP 2011©