Canadian government slams Tim Hortons for using his app to spy on customers

Canada's privacy watchdog says Tim Hortons used its mobile app to collect "huge amounts of location data" from users, including when they visited competing coffee shops. Yesterday, the Office of Canada's Privacy Commissioner released the results of a 2020 investigation into the coffee and donut chain, demanding that it remove any remaining location data and limit future collections. The commission says Tim Hortons has agreed to enforce the rules.

The full report outlines a broad, aggressive effort to target the behavior of Tim Hortons' customers -- though the company apparently never actually used the data for that purpose. It notes that in May 2019, Tim Hortons updated its mobile app to collect fine, frequent location updates right from users' phones. US geofencing platform Radar analyzed patterns in the data to determine where users lived, when they worked and when they were traveling. Its near-persistent collection clashed with statements that it only collected location information while the app was open, and it updated its disclosure only after The Financial Post published an article highlighting its extensive data collection. done - the commission sparked the investigation.

According to records reviewed by the commission, Tim Hortons asked for data to support trend reports that customers were switching to their competitors - and from city locations as the COVID-19 pandemic unfolded. To track changes towards suburban people near and far from home. , its radar-enabled analysis generated an "event" whenever a user visited one of nine Tim Hortons competitors, including McDonald's, Starbucks and Second Cup Cafe. It also checked when people were visiting major sporting venues, and flagged when people left and returned to their places of business. The commission found that the radar generated an average of about 10 events per day for each user.

Tim Hortons apparently used the data to run tailored promotional offers based on users' location, but it refocused its efforts and used it only for comprehensive trend-based analysis. The commission notes that, even if the data was not accessed, it was stored by default for a year – and although it was to be considered anonymous, several studies show that it is not difficult to identify individuals. Is. Tim Hortons shut down the program in 2020, days after the investigation was announced.

Many smartphone apps track users' activities, including some that give third parties wide access to that data. Some restaurants have also openly promoted their trekking programs. In 2018, Burger King encouraged people around McDonald's to download the app and order discounted Whoppers. A Skift Table report from the same year found that many restaurants' apps tracked users without explicitly disclosing the practice. But Tim Hortons is apparently not one of them. It says its app now only uses location data to identify nearby locations for mobile ordering, and the commission found "no evidence to the contrary."