Have You Read the Canadian OBA Guidance?

Late last year the Canadian Privacy Commissioner issued online behavioral advertising guidelines, that in many ways mirrors the self-regulatory program in the United States. Companies should, according to the Canadian body, give clear and conspicuous notice about tracking activities over time in order to serve targeted advertising. In addition, companies engaging in such activities should give consumers the ability to opt-out. This notice and choice is a requirement under Canadian federal law, namely the Personal Information Protection and Electronic Documents Act (PIPEDA). In describing notice and choice mechanisms, the Office of the Privacy Commissioner suggests in its guides several steps, namely: (1) making purposes clear through a notice that isn't buried in the privacy policy; (2) sharing this notice at or before collecting information; (3) giving an opt-out preferably at or before information is collected; (4) making sure the opt-out takes effect immediately; (5) limiting collection of information to what is needed; and (6) destroying or de-identifying information after it is no longer needed.

TIP: Following the self-regulatory U.S. program will likely get companies far down the road to addressing Canadian requirements. However, if designing an OBA strategy that will encompass Canadian users, keep in mind that the Canadian privacy law is more fulsome than that in the U.S., and if subject to Canadian jurisdiction, your program should address those requirements.