Tim Hortons app tracked donut lovers' locations without consent
An investigation found the Canadian restaurant violated users' privacy.
Another food app has been caught sharing location data without asking. As CBC News reports, Canadian privacy authorities have determined that restaurant chain Tim Hortons collected "granular" location data through its mobile app without valid consent between May 2019 and August 2020. The coffee-and-donut giant was supposed to be using positional info from its partner Radar Labs for targeted ads, but the app was gathering locations as frequently as every few minutes, whether or not the app was open — even if you'd explicitly limited that collection through settings.
Investigators also found that there weren't enough contractual protections for the personal data Radar processed. The clauses were "vague and permissive" enough that Radar could have used sensitive content for its own purposes, according to the Office of the Privacy Commissioner of Canada. While Radar would have needed to anonymize the data, officials said the contract still wasn't strong enough to adequately protect users' data.
The investigation came soon after Financial Post journalist James McLeod wrote a story revealing the extent of Tim Hortons' location-gathering practices. The app checked McLeod's location over 2,700 times in less than five months, including when he traveled to Morocco. The piece prompted multiple class action lawsuits.
The privacy offices noted that Tim Hortons' real-world data use was "very limited," and that restaurant operator TDL Group agreed to delete relevant data alongside its partners. The company also agreed to create a privacy management program that kept its apps from violating privacy laws. In a statement, Tim Hortons told the CBC that it had "strengthened" its privacy team.
Even so, the findings highlight the concerns about potential app data abuse. While Tim Hortons isn't known to have misused info, other companies have put data on sale and otherwise lost control. Those compromises can lead to unwanted advertising and, in extreme cases, probes into your personal life. British Columbia privacy commissioner Michael McEvoy saw this latest investigation as proof stronger oversight was necessary, and it wouldn't be surprising if Canada and other countries took action.
