Skip to content
Schedule a Call
Call Now

The Tim Hortons App Investigation: A Call for Privacy Reform in Canada

Article by Tsaaro

7 min read

As concerns about surveillance rise in an expanding digital era, Canadian restaurant giant Tim Hortons is one of the most recent firms to face scrutiny for privacy violations. The fast-food restaurant chain is owned by Restaurant Brands International, which owns Burger King, Popeyes, and Firehouse Subs. 

According to a joint investigation launched by the Office of the Privacy Commissioner of Canada, Commission d’accès à l’information du Québec, Office of the Information and Privacy Commissioner for British Columbia, and the Office of the Information and Privacy Commissioner of Alberta in July 2020, consumers who downloaded the Tim Hortons app had their movements tracked and documented every few minutes of the day, even while the app was not active, in breach of Canadian privacy regulations.

The findings of the joint investigation conducted by the Canadian federal and provincial privacy authorities claim that the continuous and extensive collection of location data by the Tim Horton’s app was not proportionate to the benefits that the company sought to achieve from better-targeted advertising of its coffee and other items.

The app was downloaded about 10 million times between 2017 and 2020, with 8.6 million Canadian downloads and over 1 million worldwide. It currently has more than 1.6 million active users. 

According to the investigation, the app requested permission to use the mobile device’s geolocation features; however, many users were deceived into believing the information would be accessible only while the app was in use. The software monitored users for as long as the device was turned on, gathering location data continuously. 

It also used location data to determine where users lived, worked, and whether or not they were travelling. Every time a user entered or exited a Tim Horton’s competitor, their home or business, an “event” was logged. 

The inquiry revealed that Tim Hortons continued to gather heaps of location data for a year after abandoning plans to utilise it for targeted advertising, despite having no valid reason. According to the company, it only used aggregated location data in a limited way to assess user trends, such as whether consumers shifted to other coffee shops and how users’ movements changed as the pandemic spread.

While Tim Hortons ceased monitoring users’ movements in 2020, that action did not eliminate the potential of spying after the inquiry was initiated. According to the report, Tim Hortons’ contract with an American third-party location services supplier included wording so ambiguous and permissive that it would have permitted the firm to sell “de-identified” location data for its purposes.

There is a substantial danger of re-identification of de-identified geolocation data. A study conducted by the Office of the Privacy Commissioner of Canada revealed how readily persons might be recognised based on their movements. Location data is susceptible since it may identify where individuals live and work and journeys to medical facilities. It may deduce religious views, sexual preferences, social-political affiliations, and other information.

The investigation also revealed that Tim Hortons did not have a comprehensive privacy management policy for the app, which would have allowed the company to identify and resolve many of the privacy violations discovered.

Tim Hortons has agreed to implement the four privacy authorities’ recommendations which include:

  • Deleting any residual location data and instructing third-party service providers to follow suit;
  • Establish and maintain a privacy management programme that includes:
    • privacy impact assessments for the app and any other apps that it launches;
    • develop a process to ensure information collection is necessary and proportionate to the privacy impacts identified; 
    • ensure private communications are consistent with;
    • adequately explain app-related practices.
  • Provide details on the steps it has made to comply with the suggestions. 

The Tim Hortons investigation began as a result of a June 2020 National Post news article detailing the author’s discovery that the app tracked his location more than 2,700 times in less than 5 months, both in Canada and while on vacation in Europe and Northern Africa, and not just when the app was in use.

The course of the investigation conducted by Canada’s federal and provincial privacy authorities showcases a dire need for privacy reform in the country. While Tim Hortons has agreed to comply with various suggestions from authorities, there is no monetary penalty associated with the probe, which the regulators described as a restriction of their jurisdiction. Neither Alberta nor British Columbia has the authority to levy fines. While Quebec has the authority to impose penalties, the maximum amount Tim Hortons could have faced was $10,000.

Like many other jurisdictions, Canada needs to restructure its privacy regime to authorise inquiries not just when there is a breach but also as a preventative measure. Consumers will eventually have confidence that when they partake in this digital economy, they may do so with confidence because regulators will be equipped with the necessary means, including the power to investigate effectively and verify compliance.

At an organisational level, businesses must put in place solid contractual controls to limit service providers’ use and disclosure of app users’ information, including de-identified information. Failure to do so puts those consumers in danger of having their data utilised in ways they never expected, such as extensive profiling, by data aggregators.

Other Resources:

Report of Findings

Statement: Remarks by Privacy Commissioner of Canada

News release: Privacy Commissioners launch a joint investigation into Tim Hortons mobile app

1,114 thoughts on “The Tim Hortons App Investigation: A Call for Privacy Reform in Canada”

  196. seo experts us

    Nice post. I learn something more challenging on different blogs everyday. It will always be stimulating to read content from other writers and practice a little something from their store. I’d prefer to use some with the content on my blog whether you don’t mind. Natually I’ll give you a link on your web blog. Thanks for sharing.

  424. $MGMEL Mega Melania

    Write more, thats all I have to say. Literally, it seems as though you relied on the video to make your point. You obviously know what youre talking about, why throw away your intelligence on just posting videos to your blog when you could be giving us something enlightening to read?

  669. camping

    Good day! I simply wish to give a huge thumbs up for the good data you’ve got right here on this post. I will likely be coming again to your weblog for more soon.

  700. مگاپاری ثبت نام

    That is the proper weblog for anyone who desires to find out about this topic. You realize so much its nearly laborious to argue with you (not that I truly would want…HaHa). You undoubtedly put a brand new spin on a topic thats been written about for years. Nice stuff, simply great!

  869. judi bola online

    Attractive section of content. I just stumbled upon your weblog and in accession capital to assert that I get actually enjoyed account your blog posts. Anyway I will be subscribing to your feeds and even I achievement you access consistently quickly.

  1113. delivery luggage to airport

    I’m now not positive where you are getting your information, however great topic. I needs to spend a while finding out much more or working out more. Thanks for wonderful info I was in search of this information for my mission.

Leave a Reply

Your email address will not be published. Required fields are marked *

Eu Ai act
First Rules of the EU AI Act Come into Effect: What Does it Mean?
Tsaaro Consulting

First Rules of the EU AI Act Come into Effect: What Does it Mean?

The evolving digital landscape in the 21st century have placed a challenge for governments and organizations as they attempt to …

•
March 7, 2025
Digital Personal Data Protection (DPDP) Act
Exemptions Under the Digital Personal Data Protection (DPDP) Act, 2023  
Tsaaro Consulting

Exemptions Under the Digital Personal Data Protection (DPDP) Act, 2023  

Introduction  The Digital Personal Data Protection (DPDP) Act, 2023, and the Digital Personal Data Protection Rules, 2025 establish a comprehensive …

•
February 27, 2025
cybersecurity,
WHAT DRIVES CYBERSECURITY: A COMPREHENSIVE OVERVIEW 
Tsaaro Consulting

WHAT DRIVES CYBERSECURITY: A COMPREHENSIVE OVERVIEW 

In today’s interconnected world, cybersecurity plays a crucial role in protecting our digital lives. From protecting personal data to safeguarding …

•
February 21, 2025
Transfer Impact Assessments
Understand Transfer Impact Assessments: Insights from CNIL’s Practical Guide 
Tsaaro Consulting

Understand Transfer Impact Assessments: Insights from CNIL’s Practical Guide 

Introduction  A Transfer Impact Assessment (TIA) is a critical evaluation conducted under the General Data Protection Regulation (GDPR) to assess …

•
February 20, 2025
Draft DPDP Rules
The DPDP Act, 2023 and the Draft DPDP Rules, 2025: What Do They Mean for India’s AI Start-Ups?
Tsaaro Consulting

The DPDP Act, 2023 and the Draft DPDP Rules, 2025: What Do They Mean for India’s AI Start-Ups?

Introduction The Digital Personal Data Protection Act (DPDPA), 2023 and the Draft DPDP Rules, 2025 have ushered in a new …

•
February 12, 2025
Recent Comments

SHARE THIS POST

Would you like to read regular updates from Tsaaro.
Subscribe to our newsletter

Our Latest Blogs

Read what the latest hapennings in the cyber world are and learn what the
experts have to say about them

© 2024 Tsaaro Consulting. All rights reserved.
Linkedin Instagram Youtube

About Tsaaro

Resources

Other Links

Tsaaro Netherlands Office

Regus Schiphol Rijk Beech Avenue 54-62, Het Poortgebouw, Amsterdam, 1119 PW, Netherlands

Tsaaro Pune Office

Tech Centre, Rajiv Gandhi Infotech Park, Hinjewadi, Pune, Maharashtra

Tsaaro Noida Office

302, Tower C, ATS Bouquet, Noida Sector – 132, Uttar Pradesh, India

Tsaaro Bengaluru Office I

Manyata, Embassy Business Park, Outer Ring Road, Bengaluru, Karnataka

Tsaaro Bengaluru Office II

Second State, CMH Road, Indiranagar, Bengaluru, Karnataka

Call Our Experts:

+91 95577 22103

small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png

We’d love to help your organization achieve your Data Protection goals!

Schedule a complimentary consultation with our Team of Experts.