Tim Hortons used his mobile app to collect “large amounts of location data” from users, including tracking when visiting competing coffee shops, says the Canadian privacy agency. Yesterday, the Office of the Privacy Commissioner of Canada released the results of a 2020 investigation into the coffee and donut chain, demanding that it delete the remaining location data and limit future collection. Tim Hortons, according to the commission, has agreed to implement the regulations.
The full report describes a broad and invasive attempt to infer the behavior of Tim Hortons customers in order to target advertising to them, although it appears that the company never used the data for this purpose. He notes that in May 2019, Tim Hortons updated his mobile app to collect frequent, granular location updates from users’ phones. The US geofencing platform Radar analyzed data patterns to infer where users lived, when they worked, and when they traveled. Its near-constant collection clashed with statements that it only collected location information when the app was open and only updated its disclosures when the Financial Post published an article outlining its detailed data collection, causing the commission investigation.
The app guessed users’ home locations and dialed when they went to sporting events
According to commission-reviewed records, Tim Hortons sought data to support trend reports that said customers were shifting to their competitors and, as the COVID-19 pandemic unfolded, to follow up. of commutes from the city center and to the suburbs closest to home. . His radar-enabled analysis generated an “event” whenever users visited one of Tim Hortons’ nine competitors, including McDonald’s, Starbucks and Second Cup Café. He also checked when people were visiting the major sports facilities and dialed when people were leaving and returning to their place of business. The commission found that Radar generated an average of about 10 events a day for each user.
Apparently, Tim Hortons considered using the data to run bespoke promotional offers based on where users were located, but ended up refocusing his efforts and only used them for broad, trend-based analysis. The commission notes that even if the data was not used, it was still stored by default for a year, and although it was supposed to be anonymous, numerous studies show that it is not difficult to identify people. from supposedly anonymous data. Tim Hortons suspended the program in 2020, just days after the investigation was announced.
Many smartphone apps track user movements, including some that give third parties broad access to that data. Some restaurants have even openly promoted their follow-up programs. In 2018, Burger King encouraged people to download the app and order Whoppers at a discount when they were near a McDonald’s. A Skift Table report from the same year found that many restaurant apps tracked users without clearly revealing the practice. But Tim Hortons seems to be no longer one of them. He says his app now only uses location data to identify nearby locations to place mobile orders, and the commission “found no evidence to the contrary.”