The federal privacy commissioner has issued a report after investigating the Tim Hortons app and says those who downloaded the Tim Hortons app had their movements tracked and recorded every few minutes of every day, even when their app was not open which is in violation of Canadian privacy laws.

The joint investigation by federal and provincial privacy authorities concluded that Tim Hortons’ continual and vast collection of location information was not proportional to the benefits Tim Hortons may have hoped to gain from better targeted promotion of its coffee and other products. The app asked for permission to access the mobile device’s geolocation functions, but misled many users to believe information would only be accessed when the app was in use. In reality, the app tracked users as long as the device was on, continually collecting their location data.

The report says the app also used location data to infer where users lived, where they worked, and whether they were travelling. It generated an event every time users entered or left a Tim Hortons competitor, a major sports venue, or their home or workplace.  Location data is highly sensitive because it can be used to infer where people live and work, reveal trips to medical clinics. It can be used to make deductions about religious beliefs, sexual preferences, social political affiliations and more.

The investigation uncovered that Tim Hortons continued to collect vast amounts of location data for a year after shelving plans to use it for targeted advertising, even though it had no legitimate need to do so. The company says it only used aggregated location data in a limited way, for example, whether users switched to other coffee chains, and how users’ movements changed as the pandemic took hold. In addition the company could have sold the location data.

Privacy Commissioner of Canada, Daniel Therrien says, “Tim Hortons clearly crossed the line by amassing a huge amount of highly sensitive information about its customers. Following people’s movements every few minutes of every day was clearly an inappropriate form of surveillance. This case once again highlights the harms that can result from poorly designed technologies as well as the need for strong privacy laws to protect the rights of Canadians.”