Column: Mind the little ones
February 13, 2013 | Sara Perry | Comments
Here’s a sneak peek at Marketing’s special Privacy Issue, available now
They may know more about the internet than you, but children need special privacy protections online
There has been much public debate lately about the role of industry and government in regulating the collection, use and disclosure of personal information by commercial entities, especially with the advanced tracking technologies used in online behavioural advertising. Perhaps nowhere has this issue been more controversial than in the case of targeted advertising to minors.
While there have not been many cases in Canada addressing privacy issues in the context of advertising to children, the Office of the Privacy Commissioner of Canada (OPC) recently completed an investigation into the policies and practices of youth-oriented social networking site Nexopia. The complaint centered around six issues, including: Nexopia’s disclosure of user profiles to the public; default privacy settings; consent for the collection of personal information; adequate disclosure of advertising practices; sharing of personal information with third parties; and the retention of the personal information of non-users.
The OPC found Nexopia in breach of Personal Information Protection and Electronic Documents Act (PIPEDA) and made a total of 24 recommendations to the organization to bring it into compliance. This decision reflects the OPC’s strong interest in children and youth privacy, which was cited as a “key issue” in the OPC’s 2011 Annual Report.
The controversy continues over the level and extent to which the government should regulate the privacy of Canadians and minors in particular. When addressing privacy issues in the context of minors, marketers should take a more stringent approach to the consent and other requirements under Canada’s general privacy and advertising statutes, and should aim to abide by these best practices:
• Disclosure and transparency – organizations should clearly and prominently explain in age-appropriate language how and why the personal information of children will be collected, used and disclosed and should not use the information for any other purposes
• Consent – organizations should use a reliable method of obtaining verifiable parental consent
• Limit the data collected – organizations should only collect that information that is necessary to fulfill the purposes at hand
• Implement appropriate safeguards – as with all personal information, marketers should ensure that appropriate safeguards are in place to protect the security of the information.
It wouldn’t be surprising to see more cases like this. Due to significant advancements in online technologies, including the use of behind-the-scenes tools such as cookies, advertisers are able to easily (and unknowingly) collect personal information and target, identify and track patterns in user behaviour, including those of children.
Youth provide advertisers with a wealth of personal information when interacting with games and social networks or completing online registration forms or surveys. For advertisers, this is great news, as these online tracking mechanisms provide a more effective means to reach out to intended audiences with directly relevant information. These tactics, however, raise broader concerns regarding consumer privacy and have led privacy regulatory authorities in Canada and abroad to develop new legislation, industry guidelines and best practices. When it comes to minors, these concerns are even more prevalent.
Children are often described as lacking the cognitive abilities to differentiate between content and advertising and, in addition, likely fail to understand how their information is being collected and used. Children are also less likely to be skeptical of advertising or worry that their information will be collected, used or shared inappropriately. Compounding the issue further is the concept of consent. Even when internet sites request parental consent prior to collecting information or tracking behaviour of minors, it is difficult to confirm that consent is in fact being given by the parent.
As it currently stands in Canada, there are no laws that specifically address online advertising to children or the collection, use and disclosure of personal information of children. Rather, general advertising and privacy laws apply including, in the private sector, the federal PIPEDA and its provincial counterparts in Alberta, British Columbia and Quebec. Generally speaking, PIPEDA requires that commercial organizations identify the purposes for which personal information is being collected in a clear and transparent manner, obtain consent for the collection, use and disclosure of such personal information and only collect personal information that a reasonable person would consider appropriate in the circumstances.
And, before collecting, using or disclosing personal information that is “sensitive in nature” (i.e., the personal information of minors, especially those under the age of 13) the OPC will expect an express form of consent be obtained. Proposed amendments to PIPEDA include a new definition of “valid consent” designed to “further protect the personal information of minors.” Specifically, the amendment states that “the consent of an individual is only valid if it is reasonable to expect that the individual understands the nature, purpose and consequences of the collection, use or disclosure of personal information to which they are consenting.” This may result in enhanced notice obligations, both in substance and delivery, including the use of age-appropriate language to communicate privacy practices to the appropriate audience.
Further, the Privacy Commissioner’s Privacy & Online Behavioural Advertising Guidelines (OBA Guidelines) updated in June 2012 were intended to help advertisers make their online behavioural advertising practices fair, transparent and compliant with PIPEDA. The OBA Guidelines state that, as it is difficult to ensure meaningful consent of minors to online behavioural advertising, “as a best practice, organizations should avoid tracking children and tracking on websites aimed at children.”
Sara Perry is a lawyer with the national law firm of Heenan Blaikie LLP, in the Marketing & Advertising and Entertainment groups. Joanna Fine, a lawyer in the Privacy & Information Management Law group, contributed to this column.
For more expert commentary on the industry’s most pressing issues, subscribe to Marketing.