(Bloomberg) — Tim Hortons, the ubiquitous Canadian coffee chain owned by Restaurant Brands International, violated Canadian privacy rules by tracking its customers’ movements with its mobile app even when the app wasn’t in use, a government investigation found.
The company was told Wednesday to shut off that capability after an investigation by federal and provincial authorities found that the Tim Hortons app “misled many users to believe information would only be accessed when the app was in use.”
“In reality,” the authorities said, “the app tracked users as long as the device was on, continually collecting their location data. The app also used location data to infer where users lived, where they worked, and whether they were traveling. It generated an ‘event’ every time users entered or left a Tim Hortons competitor, a major sports venue, or their home or workplace.”
The investigation also found that Tim Hortons “continued to collect vast amounts of location data for a year after shelving plans to use it for targeted advertising, even though it had no legitimate need to do so.”
Concerns about the Tim Hortons app were first raised in a 2020 newspaper report by the Financial Post, which revealed that the app had collected a vast trove of data on its users.
Tim Hortons says it will implement the recommendations in the report. They include deleting any remaining location data and directing third-party providers to do the same; establishing and maintaining a privacy management program; and reporting back to the authorities with details on the measures it has taken to comply with the recommendations.
The joint investigation was conducted by the privacy commissioner of Canada and provincial authorities in Quebec, British Columbia and Alberta.
More stories like this are available on bloomberg.com
©2022 Bloomberg L.P.
