On Dec. 6, 2011, the Privacy Commissioner of Canada launched new guidelines under the Personal Information Protection and Electronic Documents Act, PIPEDA for online behavioral advertising i.e. tracking users’ online activities in order to deliver targeted advertisements that are based on past activities and interests. There is a battle between web site owners desire to make increase revenue from personal information (PI) and privacy.

These guidelines provide that web site owners require a user’s knowledge and consent for the collection, use, or disclosure of personal information and that the purposes for which a user’s information is to be collected, used or disclosed be explained in a clear and transparent manner. Express consent (opt-in) is required when dealing with sensitive information whereas implied consent (opt-out) can be used when the information is less sensitive.

Implied consent i.e. "opt-out" consent may be used if:

First the user must be:

made aware of the purposes for the practice in a manner that is clear, obvious and understandable;

informed of these purposes at or before the time of collection and should be provided with information about the parties involved in the advertising; and

able to easily opt-out of the practice, ideally at or before the time the information is collected.

Also, the opt-out should both take effect immediately and be persistent, while the information collected and used:

must be limited, to the extent practicable, to non-sensitive information (for example, avoiding sensitive data such as health information); and

should be destroyed as soon as possible or "anonymised," so if someone gains access to it through say hacking, it can't be used to identify specific individuals.

The use of tracking techniques of which users are unaware of but can't decline such as web bugs, web beacons, and super cookies “should be avoided.”

These guidelines are consistent with the wording of PIPEDA and provide some guidance for the drafting of Canadian privacy policies. It is interesting to note that the use of web bugs and beacons was not forbidden but only “should be avoided.” Of great interest will be interesting to see how the large Internet companies such as Google and Facebook measure up to these guidelines and the Commissioner’s response.