Tim Hortons app data

Tim Hortons, something of a national institution in Canada, gathered mountains of location data from users of its app, in violation of Canadian law.

“In June 2020, we took immediate steps to improve how we communicate with guests about the data they share with us and began reviewing our privacy practices with external experts. Tim Hortons planned to use data for targeted advertising, but continued to gather the detailed information even after those plans were shelved, the announcement says. In Tim Hortons’ case, the location data was used to track “every time users entered or left a Tim Hortons competitor, a major sports venue, or their home or workplace,” and Tim Hortons said it used the data to determine whether users switched to another coffee chain and perform other analysis, the announcement reads. We’ve strengthened our internal team that’s dedicated to enhancing best practices when it comes to privacy and we’re continuing to focus on ensuring that guests can make informed decisions about their data when using our app.” Most egregiously, “The Tim Hortons app asked for permission to access the mobile device’s geolocation functions, but misled many users to believe information would only be accessed when the app was in use. This case once again highlights the harms that can result from poorly designed technologies as well as the need for strong privacy laws to protect the rights of Canadians,” Daniel Therrien, the Privacy Commissioner of Canada, said in a statement published with the announcement.

The Tim Hortons mobile ordering app violated the law by collecting vast amounts of location information from customers, an investigation by federal and ...

The investigation found that Tim Hortons' contract with a U.S. third-party location services supplier contained language so "vague and permissive" that it would have allowed the company to sell "de-identified" location data for its own purposes. "The company says it only used aggregated location data in a limited way, to analyze user trends -- for example, whether users switched to other coffee chains, and how users' movements changed as the pandemic took hold." "The investigation uncovered that Tim Hortons continued to collect location data for a year after shelving plans to use it for targeted advertising, even though it had no legitimate need to do so," the statement said.

'Tim Hortons clearly crossed the line by amassing a huge amount of highly sensitive information about its customers,' federal privacy commissioner Daniel ...

Radar Labs Inc., a U.S. company that helped develop the software, is named as a co-defendant in two of the four Canadian lawsuits. Whenever the software detected that a device was moving, it generally collected location data every 2.5 to six minutes, depending on the version of the app being used, they wrote. Concerns that the Tim Hortons app was tracking users’ movements were first reported in a 2020 National Post article. They also have told Tim Hortons to create a privacy-management program for any apps, and to improve privacy communications. The investigation was conducted by the federal privacy commissioner with counterparts in Quebec, British Columbia and Alberta. The officials have told Tim Hortons to delete any data it still holds on customers’ locations, and to instruct third-party data service providers to do the same. The investigation, launched in 2020, found that the app’s permissions “misled many users” by suggesting that it would only gather their information while they were using it.