By Dow Jones Business News,
January 15, 2014, 01:41:00 PM EDT
By Paul Vieira
OTTAWA--Canada's privacy watchdog said Wednesday that Google Inc. violated the country's privacy laws after it used
a person's Internet searches about a personal health matter to tailor advertisements he would see when surfing online.
Google, whose ability to track individuals' online activity has drawn concern and ire from privacy advocates and
government authorities, cooperated with the watchdog's investigation and is "pleased to be resolving the issue," a
company spokeswoman said. The watchdog, meanwhile, said it received assurances from the Mountain View, Calif., Internet-
search company that it would take steps to prevent future such occurrences, with a series of agreed-upon measures to be
implemented by June.
This marks the second time Canada's Privacy Commissioner has said Google violated Canada's privacy laws. It took
the company to task in 2010 when Google was found to have collected information from unsecured wireless networks for its
Street View program. Google, which faced similar scrutiny in other countries, agreed to delete the data and boost
training for employees.
In the latest incident, Canada's Privacy Commissioner said that, after a six-month investigation, it determined
Google delivered ads to a Canadian resident based on websites he had visited when researching how best to treat his
sleep apnea. Later, unrelated websites the complainant visited for roughly a month featured ads highlighting devices,
most notably CPAP masks, which help apnea sufferers breathe in pressurized air through a face mask attached to a hose
and bedside pump.
Google is able to deliver such ads through the use of browser cookies, which help track users' actions as they surf
from site to site on the web.
The privacy watchdog said Canada's guidelines on behavioral advertising forbid advertisers from collecting
sensitive personal information, such as individuals' health information, for the purpose of delivering tailored pitches.
Further, privacy laws mandate an individual's explicit consent is required for the collection and use of personal
information, such as a medical condition.
"Implied consent for the collection or use of the complainant's sensitive personal health information for the
purpose of delivering ads based on the complainant's online behavior is not appropriate. Express consent is required,"
the privacy commissioner said in a ruling posted on its website.
In November, Google agreed to pay $17 million to settle allegations by 37 U.S. states and the District of Columbia
that it placed unauthorized tracking cookies on Web browsers in 2011 and 2012. France and Spain also have levied fines
against Google in recent months for privacy violations.
The Canadian watchdog said Google has committed to boost staff training on potential privacy violations and
increased monitoring of so-called remarketing campaigns.
Write to Paul Vieira at email@example.com
Subscribe to WSJ: http://online.wsj.com?mod=djnwires
(END) Dow Jones Newswires
Copyright (c) 2014 Dow Jones & Company, Inc.