Earlier this month, we told you about an investigation by the Financial Post that revealed the Tim Hortons mobile app was tracking the location of older Android phones.
Now, Canada’s privacy commissioner and three other provincial counterparts in B.C., Alberta and Quebec are investigating the Tim Hortons mobile app.
The Office of the Privacy Commissioner of Canada (OPC) says it will “look at whether the organization is obtaining meaningful consent from app users to collect and use their geolocation data for purposes which could include the amassing and use of detailed user profiles, and whether that collection and use of the data is appropriate in the circumstances.”
In response to the investigation, Tim Hortons told CBC News in a statement, “Since Tim Hortons launched our mobile app, our guests always had the choice of whether they share location data with us, including ‘always’ sharing location data — an option offered by many companies on their own apps.”
The issue at stake was for Android smartphones running older software versions. Only in Android 10 did Google add the ability for users to limit app location tracking to only while an app was in use—a feature iPhone users have had since 2014.
Tim Hortons said location data was required for its store finder feature. But the Post investigation revealed numerous third-party companies were being used to track user location data.
It is notable to me that Tim Hortons insisted that users were giving informed consent to this kind of location tracking, but then once it was made public, they discontinued the practice less than a month later. My original story: https://t.co/PGAcuTvd9g
— 𝙅𝘼𝙈𝙀𝙎 🤨 𝙈𝘾𝙇𝙀𝙊𝘿 (@jamespmcleod) June 29, 2020
It’s worth noting only after the Post’s investigation did Tim Hortons make a change to its mobile app, less than a month later. “We recently updated the Tim Hortons app to limit the collection of location data to only while guests have our app open, even if a guest has selected ‘always’ in their device settings,” added the spokesperson.
“The federal Privacy Commissioner’s office considers this to be an issue of great importance to Canadians given the privacy issues it raises. Geolocation data can be very sensitive as it can reveal information about the habits and activities of individuals, for example, medical visits or places that they regularly frequent,” concluded the OPC press release.