Websites leaking users' information, privacy watchdog warns

Some leading Canadian websites are inappropriately passing the personal information of their users to third-party sites, such as advertising companies, says the federal privacy watchdog.

The information includes names, email addresses and postal codes apparently without consent and possibly in violation of federal privacy law, Privacy Commissioner Jennifer Stoddart said Tuesday.

Research commissioned by Stoddart's officeturned up notable concerns with about one-quarter of the 25 shopping, travel and media sites they tested.

For instance, when people signed up online to receive promotions from a particular shopping site, their email address, username and city were disclosed to marketing firms and analytics companies that measure website usage, the office said.

In another case, a "well-known Canadian media site" where users register to manage subscriptions and post comments handed over the username, email address, and postal code to a content delivery and marketing service, an advertising network, and a news content provider.

The researchers found "significant" privacy concerns with six sites, and had questions about the practices of an additional five.

The websites are sophisticated operations run by large organizations, said Stoddart. But she stopped short of naming them, since the research was intended to provide a representative sampling of the Canadian landscape. Given that, it's likely that other websites are also divulging personal information, she warned.

'Wake-up call' about Canadian law

Stoddart has written to 11 organizations seeking information about their practices and, in some cases, explanations as to how they will make changes to ensure compliance with privacy law.

"Our research serves as a wake-up call to all online services to ensure they are complying with Canadian law and respecting the privacy rights of people who use their sites," Stoddart said in a statement.

"It is clearly possible for organizations to operate successfully in the online world without leaking people's personal information a majority of the websites we looked at were not doing it."

In the House of Commons, New Democrat MP Charmaine Borg, the party's critic for digital issues, called on the government to "take serious steps to address the serious privacy concerns of Canadians."

Mike Lake, the parliamentary secretary to the industry minister, said the government would continue to help protect consumers and businesses from the misuse of their personal information.

The commissioner's office decided to undertake the research after international studies revealed similar problems. Concerns arise, they said, because many popular websites earn revenue through advertisements placed by third-party organizations.

Loading a website page triggers a request to the advertiser to display an ad a request that may contain personal information about the person online, Stoddart said.

In addition, the request might feature information about the particular page the person is visiting.

"A tenet of good privacy is to allow individuals to make informed choices about whether to share or not share their personal information," says the commissioner's office.

"It is a privacy concern if websites are disclosing personal information without making users aware of this practice and seeking their consent."