Tim Hortons, other popular apps collect and share Canadians’ data

Some of the most popular apps in Canada collect and share user data with multiple companies, sparking calls for better privacy laws.

CBC Marketplace investigated six of the most popular apps in Canada, Tim Hortons, PC Optimum, the Weather Network, Facebook, Amazon and YouTube. University of Calgary computer science professor Joel Reardon and his team then tested the apps on Android, while privacy law app evaluator Privo did the same on iOS.

Tim Hortons, notably, started collecting swaths of data immediately upon the launch of its app. This included many details on your device (such as its camera specs, ringtones and unique identifiers), names of nearby Wi-Fi routers to determine location and more. A Tim’s representative told Marketplace this data is only used for “fraud prevention, account protection, and payment abuse prevention,” not marketing or ads. (Notably, Tim Hortons was previously sued for how its app collected data.)

PC Optimum, meanwhile, collected the user’s first name, email address, device’s unique identifier, how and when they interact with the app, and more. But the most important point here is that Marketplace‘s investigators questioned why the PC Optimum app sends data to 10 outside companies. A Loblaw representative didn’t provide any answer for this, simply saying it doesn’t sell user data and instead uses it to improve everyday shopping features.

The Weather Network was comparatively a bit scaled back in terms of data collection. Per Marketplace, the app gathers info on the user’s precise latitude and longitude, local weather conditions, and the device’s unique advertising ID. Investigators noted this could be used for targeted ads, but there wasn’t any mention, at least, of more extensive data collection and sharing. Weather Network parent company Pelmorex told Marketplace it doesn’t sell user data but acknowledged it could be used for targeted ads.

Shockingly, the investigation’s findings for Facebook weren’t quite as damning as you might expect. Specifically, the app extensively tracked user habits on Facebook, as well as the metadata of images in your camera roll, regardless of whether they were uploaded. However, investigators said it didn’t appear as if data was shared with third parties. This is perhaps surprising considering parent company Meta has long been the subject of privacy concerns, including, most recently, with its camera-equipped Ray-Ban smart glasses. (For what it’s worth, a Meta spokesperson declined to comment to Marketplace.)

In terms of Amazon, investigators said the app collected data based on what users were searching for, including “sensitive” products, as well as the device’s advertising ID. However, there was no evidence that data was sent to third parties. Investigators noted this was the norm, while an Amazon spokesperson said it doesn’t sell data and offers options for users to fine-tune how their data is collected and used.

And finally, there’s YouTube, which Marketplace reports wasn’t sending data to third parties. It also noted that in accordance with the policies of parent company Google, the YouTube app didn’t run targeted ads on children’s content. In terms of a statement, Marketplace says a YouTube representative simply said it doesn’t sell users’ personal information.

Overall, that’s clearly the big message these companies want to send, even when their apps are collecting and sharing data in other ways. PC Optimum, in particular, seems egregious, passing on data to no less than 10 companies for a simple loyalty program.

In response to these findings, former Canadian privacy commissioner Ann Cavoukian told Marketplace that Canadians “lack total control” over how their data is used. The only real recourse Canadians have, she said, is to avoid using these apps entirely. Because of that, she called on the Canadian government and current privacy commissioners to implement stronger privacy laws.

And it’s not just these apps. A previous MobileSyrup investigation found that many Canadian carrier apps include trackers for multiple third-party companies, including Google, Facebook, and more.

Source: CBC Marketplace