Tim Hortons used its mobile phone app to collect “large amounts of location data” from users, including tracking when they visited competing coffee shops, says Canada’s privacy guard. Yesterday, the Office of the Privacy Commissioner of Canada released the results of 2020 survey into the coffee and donut chain, demanding that it remove any remaining location data and limit future collection. Tim Hortons, the commission says, agreed to implement the regulations.
The full report is outlined an extensive, intrusive attempt to deduce the behavior of Tim Hortons’ customers for advertising purposes – although the company apparently never actually used the data for that purpose. It notes that in May 2019, Tim Hortons updated his mobile app to collect grainy, frequent local updates from users ’phones. American geofencing platform Radar analyzed patterns in the data to conclude where users lived, when they worked, and when they traveled. Its almost constant collection collided with statements that it only collected local information when the program was opened, and it only updated its disclosures when the Financial Mail published an article showcasing its detailed data collection – triggering the commission’s inquiry.
According to commission-reviewed records, Tim Hortons searched the data to support trend reports saying customers are shifting to their competitors – and as the COVID-19 pandemic unfolded, to track changes away from downtown locations and closer to home suburbs. . Its Radar-enabled analysis generated an “event” whenever users visited one of nine Tim Hortons competitors, including McDonald’s, Starbucks and Second Cup Café. It also monitored when people visited major sports venues, and it marked when people left and returned to their place of business. The commission found that Radar generated an average of about 10 events per day per user.
Tim Hortons apparently considered using the data to run tailored advertising offers based on where users are located, but it ended up refocusing its efforts and using it only for broad trend analysis. The commission notes that even if the data was not used, it was still kept in default for a year – and although it was supposed to be anonymised, many studies show that it is not difficult to identify individuals on the basis of allegedly anonymous data. Tim Hortons discontinued the program in 2020, a few days after the survey was announced.
Many smartphone apps track users’ movements, including some give third parties wide access to that data. Some restaurants have even openly advertised their tracking programs. In 2018, Burger King encouraged people download the app and order discounted Whoppers when in the vicinity of McDonald’s. A Skift Table report of the same year found that the apes of many restaurants tracked users without clearly revealing the practice. But Tim Hortons is no longer one of them. It says its program now only uses local data to identify nearby locations to make mobile orders, and the commission “discovered no evidence to the contrary.”