Cookies: A Bite In Cybernauts' Privacy? A Canadian-European Overview

• Published date: 20 May 2020
• Author: Ms Julie Uzan-Naulin and William Deneault-Rouillard
• Subject Matter: Media, Telecoms, IT, Entertainment, Privacy, Data Protection, Privacy Protection, Advertising, Marketing & Branding
• Law Firm: Fasken

Cookie banners are increasingly prevalent on internet sites. A section about cookies may appear in privacy policies and, sometimes, even an entire policy is devoted exclusively to them.

But what is a "cookie"? Also known as "HTTP cookies", "browser cookies" or "web cookies", a cookie is a small piece of digital data in the form of a text file sent by a website and saved locally on the user's device (computer, tablet, cell phone) through the web browser used while browsing on the Internet, often without the user's knowledge.

Cookies perform what are often essential functions. For example, authentication cookies¹ track when a user has logged into a website and under what name.² Without such a mechanism, the site would not know, for example, if it should require the user to identify themself when logging in. Tracking cookies, especially third-party tracking cookies, which belong to a different domain than the one indicated in the address bar,³ unlike first-party cookies which are related to the domain appearing in the address bar, are being used at an exponential rate. This type of cookie appears when web pages present content from third-party sites, such as publicity banners, and track the user's browsing history to suggest relevant advertising adapted to the user's profile.

But can a cookie be considered personal information?

1. Situation in Canada

(a) Concept of "personal information"

As there is currently no legislation in Canada that directly refers to cookies, can a cookie be considered "personal information" under Canadian laws regarding personal information, in which case privacy laws would apply? In other words, can a cookie be "information about an identifiable individual,"⁴ or is there a "serious possibility that an individual could be identified through the use of that information, alone or in combination with other available information"?⁵ While, in principle, Canadian case law requires a broad interpretation of the concept of personal information,⁶ up to now it is silent regarding the interpretation of both the provincial and federal laws as to whether cookies meet the definition of personal information.

In 2011, the Office of the Privacy Commissioner of Canada (the "Commissioner") released its guidelines about this issue concerning tracking cookies. It stated that online behavioural advertising and the tailoring of advertisements based on the user's browsing activities, which include purchasing patterns, "shopping cart" items saved via online shopping platforms and search histories, involves the collection of information by third parties receiving these tracking cookies. As such, "[g]iven the scope and scale of information collected, the powerful means available for gathering and analyzing disparate pieces of data and the personalized nature of the activity, it is reasonable to consider that there will often be a serious possibility that the information could be linked to an individual."⁷

In other words, the information collected and saved through cookies as part of online tracking and targeting for the purpose of providing personalized advertising, "will generally constitute personal information"⁸ as defined under the Personal Information Protection and Electronic Documents Act9(the "PIPEDA").

(b) Consent

It should be noted that the PIPEDA, just like the other provincial laws in this area, generally requires consent in order to collect, use and disclose personal information. This consent may be express or implied, depending on the circumstances and certain factors such as the sensitivity of the information involved.

Specifically regarding the use of cookies for online behavioural advertising, the Commissioner considers that implied consent is valid when certain conditions are met. In particular, Internet users must be informed, at or before the time of collection, of the purposes for this practice in a manner that is clear and understandable and about the various parties...