Google's Targeted Health Ads Violate Canada Privacy Statute, DPA Rules

Bloomberg Law: Privacy & Data Security brings you single-source access to the expertise of Bloomberg Law’s privacy and data security editorial team, contributing practitioners,...

By Peter Menyasz  

Jan. 16 --Google Inc.’s use of sensitive personal health information to target individuals with health-related advertisements violated Canada's privacy law, the Office of the Privacy Commissioner of Canada ruled in a report made public Jan. 15.

Google has agreed to resolve the issue by June 2014, the national data protection authority said in a Jan. 15 statement.

A Google Canada spokeswoman confirmed Jan. 15 that Google has agreed to take steps to resolve the issue, particularly given its privacy policy, which prohibits the use of sensitive health and medical information for interest-based advertising. “We've worked closely with the Office of the Privacy Commissioner throughout this process and are pleased to be resolving this issue,” the spokeswoman told Bloomberg BNA.

The use of personal health information to drive online behavioral advertising is a violation of the Personal Information Protection and Electronic Documents Act (PIPEDA) and the DPA's guidelines on online behavioral advertising, Interim Privacy Commissioner Chantal Bernier said in a statement accompanying the release of PIPEDA Report of Findings 2014-001.

“Most Canadians consider health information to be extremely sensitive. It is inappropriate for this type of information to be used in online behavioral advertising,” she said. “Organizations such as Google must ensure privacy rights are respected.”

FTC Cooperation Cited

Bernier said that her office's investigation of Google's targeted health ads benefited from collaboration with the U.S. Federal Trade Commission.

FTC Bureau of Consumer Protection Director Jessica Rich said in the Canada DPA's statement that collaborative investigations are critical in addressing the increasingly global scope of privacy issues.

The federal privacy agency said in its ruling that its investigation responded to an individual's complaint about the delivery of tailored advertisements through Google's AdSense service. The individual alleged that after he searched online for medical devices for sleep apnea, he was “followed” by ads for such devices when he visited websites that display ads from Google's AdSense service, the agency said.

Technical testing by the agency's investigators verified the allegations, finding that an interest in continuous positive airway pressure devices through a Google search was followed by the presentation of advertising for those devices when visiting unrelated sites about news, weather or reference information that also displayed Google advertisements, the ruling said.

“Since Google did not seek express consent in the circumstances, we are of the view that in this context, Google has contravened” PIPEDA, the agency concluded in its findings.

Ad Services Remarketing

Google responded to the complaint by indicating that its privacy policy states that, when tailored ads are displayed, the company will not associate a cookie or other identifiers with sensitive categories such as health information, the DPA said in the ruling.



“It is inappropriate for this type of information to be used in online behavioral advertising. Organizations such as Google must ensure privacy rights are respected.”  


Chantal Bernier, Interim Privacy Commissioner,
Office of the Privacy Commissioner of Canada

Google said the complaint related to “remarketing” campaigns in which advertisers target ads to recent visitors to their sites and acknowledged that some users of its ad service didn't comply with the prohibition against interest-based advertising related to sensitive issues, the DPA said. Google agreed to provide additional information on its privacy policy to advertisers involved in remarketing campaigns and would offer further training to its staff on addressing potential privacy violations, the ruling said.

The investigation also identified shortcomings in Google's systems for monitoring compliance with its privacy policy, and Google committed to increasing its monitoring of remarketing campaigns for possible privacy violations and to upgrading its automated review system, the DPA ruling said.

The ruling concluded that the complaint was “well-founded” but also that because Google has proposed remedial measures it has been “conditionally resolved.”

Bernier said in her statement that the agency will follow up its investigation of Google's practices by reviewing whether other advertising networks are complying with Canadian privacy law. “We will be contacting various advertising stakeholders in the near future to share these investigation results and remind them of their privacy obligations.”


To contact the reporter on this story: Peter Menyasz in Ottawa at

To contact the editor responsible for this story: Donald G. Aplin at

PIPEDA Report of Findings 2014-001 is available at

Request Bloomberg Law: Privacy & Data Security