Lack of a Better Word

Recently it has been reported that Google broke Canada’s privacy rules.  This goes to the fact that personal health information cannot be collected and held for marketing purposes (amongst others I presume). CBC reports that

Canada’s interim privacy commissioner says Google has been caught afoul of the law by displaying web ads linked to a person’s health history.

An investigation led by Chantal Bernier, who has stepped in for outgoing privacy commissioner Jennifer Stoddart, backed up a man’s complaints that he was seeing so-called behavioural advertisements based on his web browsing history.

After searching for information about devices to treat sleep apnea, he began to see ads for those devices as he browsed the web.

While behavioural advertising is not illegal, Canada’s privacy law does not allow consumers to be targeted based on “sensitive personal information,” including a person’s health.

While Bernier says Google’s privacy policy outlaws displaying advertisements based on race, religion, sexual orientation or health, the Mountain View, Calif.-based company acknowledged that some advertisers using Google’s ad-serving platform were not following the policy.

Let’s make the differentiation here.  First a review of the ads on a search.

Google’s display ads for paid search runs on your search habits. The search terms are used to deliver ads. If you put in a health related word and it relates to the keywords in an ad group, then the associated ad will be displayed. Even a small campaign will have multiple (up to 26) groups of keywords. The amount of keywords in each group could run into the thousands. Making a campaign successful also depends on a category such as real estate or automotive. Google makes it the responsibility of the advertiser to ensure they follow the rules.

So is that it? Not quite. The above deals with search such as Diabetes – perhaps you wanted the Canadian Diabetes Association’s web address. But if you searched for it and got the info you needed and the website address, or if you just happened to visit many health related sites related to diabetes, then that is the information that was kept on your browser’s cookie list.  The next time you visited a site such a  YouTube which is part of the Google Network then a diabetes related ad, could then be served up regardless of how recent you had searched for a term. This information is relayed to the site  from your local cookie file of preferences and then serves up a related ad from the Google Network which could include a key word. Such as an ad from the CDA. The image below shows one which asks if you have it, when a search was done. Relating the word diabetes to an ad – actively relaying an ad through a proactive activity.

Google has more than just paid search ads though. The Google ad network delivers ads on many sites that have nothing to do with search – such as the ad overlays on video on the Google owned YouTube site. An active relaying of an ad through a non related activity.

 

What Google was doing was utilizing your past search and site visit information and then using that to display related ads. Google is going to do this upgrade by June, but one would have thought they would have done this before this. Seems they need to be slapped before they address any privacy concerns. Just because one is big, does not excuse this oversight – benign or not.

‘Most Canadians consider health information to be extremely sensitive. It is inappropriate for this type of information to be used in online behavioural advertising.’- Interim Privacy Commissioner Chantal Bernier

Now you know a bit more than just the high level headline grabbing this story has generated. Being non proactive and getting a health ad is the real issue that rubs the privacy laws in Canada.