Location-Based Marketing: Companies Are Tracking You

We discussed this with Anne-Sophie Letellier, Digital Security Specialist, Senior Information Security Analyst at CBC/Radio-Canada.

How is geolocation data collected?

Every time we want to download an application we must, as a user, accept some conditions of use and a privacy policy. This is when the application, in a way, will ask us to access our data.

When we talk about geolocation we refer to data that is collected because the application has access to the GPS module of our cell phone. But so can our IP address, that is, the address of a mobile device in a network and on the Internet, which can give a rough geographical indication.

Businesses can also gain access to your location without going through your phone’s GPS module, by triangulating through nearby cell towers.

How is this geolocation data used?

The answer could be different for each of the companies in question. But, as a general rule, what we see most often is for marketing purposes. The collection of this data provides information about potential customers.

They can indicate, for example, which stores these people frequent, what time they are most likely to be home, etc. All this information can help different companies, mainly for advertising purposes, to present targeted advertising.

For example, we can know if the person likes to drink alcohol a lot, if the geolocation has indicated that they go often to the SAQ, that they go often to bars. If a person goes to the hospital frequently, it can be said that he is at risk of having health problems and he can be referred to pharmaceutical advertisements. This is where all of this information can be extremely useful to advertisers.

Are these practices properly supervised?

Our personal data protection laws are very poorly adapted to respond to this reality. We do not have a regulatory body that can pass judgment. The Canadian Privacy Commissioner can make recommendations, but after that, he must do so on a case-by-case basis. There is no framework that is very clear and defined. So it’s very easy for companies to take advantage of that.

This is something that we hope will be resolved fairly quickly because both Quebec and Canada are currently taking steps to update these laws.

On the other hand, small, medium and even large companies will say: Listen, we also need to collect this data to make our products profitable.. And so, when these laws are debated, we find, on the one hand, the protection of privacy and, on the other, this famous value of innovation; and this is often where the shoe pinches. The ideal would be to find other ways for companies to be profitable.

As a user, how do you protect yourself?

There are many things to do as an individual. Several operating systems have built into their operation a way to block this tracking. Every time there is a little arise [fenêtre contextuelle] who says : Ask the app not to track you, to accept. There are limits to this, as many apps are starting to find ways around [ce blocage].

So it’s important to demonstrate some digital minimalism. Take the Tim Hortons app as an example. He noticed that the app, in its terms of use, told users that it collected their geolocation data only when the app was turned on. However, according to the privacy commissioners’ investigation, the app collected geolocation data at all times, whether it was open or closed. This is extremely problematic and it can also be inferred that it is something that can happen with many other applications.

Therefore, if you don’t use an app, it’s a good practice to remove it, as it avoids giving a company access to a data source that they might mismanage. As a user, you do not control what the company does. We give our consent, but once we have downloaded the application, we also give you access to the different elements of our phone, including geolocation.

Collected comments have been edited for clarity and conciseness.