Canadian government criticizes Tim Hortons for invasive app tracking

Tim Hortons used his mobile app to collect “huge amounts of location data” from users, including tracking when they visited competing coffee shops, the Canadian privacy watchdog says. Yesterday, the Office of the Privacy Commissioner of Canada released the results of: a study from 2020 in the coffee and donut chain, demanding that it delete all remaining location data and restrict future collection. Tim Hortons, the commission says, has agreed to implement the regulations.

The full report outlines a sweeping, invasive attempt to divert customer behavior from Tim Hortons to target advertising at them — though the company apparently never used the data for that purpose. It notes that in May 2019, Tim Hortons updated its mobile app to collect detailed, frequent location updates from users’ phones. US geofencing platform Radar analyzed patterns in the data to determine where users lived, when they worked and when they traveled. The near-constant collection clashed with statements that it only collected location information when the app was open, and its disclosures only updated when the Financial item published an article uncovering the detailed data collection — fueling the commission’s investigation.

According to data reviewed by the committee, Tim Hortons sought the data to support trend reports that said customers were switching to its competitors — and as the COVID-19 pandemic unfolded, to track shifts from downtown locations to closer. home suburbs . The Radar-based analysis generated an “event” each time users visited one of nine Tim Hortons competitors, including McDonald’s, Starbucks and Second Cup Café. It also monitored when people visited major sports venues and flagged when people left and returned to their businesses. The committee found that on average, Radar generated about 10 events per day for each user.

Tim Hortons apparently considered using the data to tailor promotional offers based on where users were located, but eventually refocused its efforts and only used it for broad trend-based analysis. The committee notes that even if the data was not used, it was still kept for a year by default – and although it had to be anonymized, numerous studies show that it is not difficult to identify individuals from supposedly anonymous data. Tim Hortons retired from the program in 2020, a few days after the investigation was announced.

Many smartphone apps track users’ movements, including some that give third parties broad access to that data. Some restaurants have even openly advertised their tracking programs. in 2018, Burger King encouraged people to download the app and order discounted Whoppers near a McDonald’s. A Skift table report of the same year found that many restaurants’ apps tracked users without clearly disclosing the practice. But Tim Hortons is apparently no longer one of them. It says its app now only uses location data to identify nearby locations for placing mobile orders, and the commission “has found no evidence to the contrary”.