Is the advertising industry guilty of using private and sensitive information and matching that information to target consumers online? A new report from the technology analysis branch of the Office of the Privacy Commission of Canada, which was mandated to research Canadian users experience of online behavioural advertising practices, suggests that while breach of privacy is not that common, advertisers need to work harder to ensure that guidelines are being followed.

The privacy watchdog spent four months working on a report during which 9,000 ads were reviewed. Researchers were looking for how often and how well the AdChoices icon – which lets consumers opt out of advertising based on their web browsing history – appeared as ads were rolled out. Some 300 ads of the 9,000 reviewed for chosen topics on search engines like Google and Bing were ads targeted at users based on their search histories. Researchers observed that there was a lack of consistency in the appearance of the icon across platforms.

The report also picked up on several examples of re-targeting based on sensitive personal information, gleaned from searches with keywords like “pregnancy test”, “depression” and “bankruptcy.” These re-targeted ads – there were 34 in all – were displayed without giving users the option for an opt-out. And the three companies that displayed these ads were Criteo, AdRoll and Google. The use of sensitive information in ad re-targeting is a serious breach of the OPC’s privacy guidelines established in 2011, according to the report.

But the report was also welcomed by the Digital Advertising Alliance of Canada for its more positive findings.

“We were really encouraged by some of the stats in there,” says Julie Ford, executive director of the DAAC, who welcomed the report’s assessment that 96% of targeted ads offered users an opt-out option. The DAAC, which works to enhance the transparency of online advertising, and has developed a self-regulatory framework to protect users’ privacy. This includes the blue triangular AdChoices icon, which is meant to inform users that a company will respect their choice to participate in or opt out of interest-based ads.

Ford calls the report a “snapshot observation” because of its relatively small sample size. “The observations that they released will help us grow. We’re 18 months old so it’s a good early look at whats going on, and it’s nice to know that consumers are starting to understand what the icon means.” The DAAC currently has 55 members, and hopes to reach out to more DSP exchanges and encourage them to be part of the process.

Meanwhile, the OPC report recommends that advertisers work on ensuring they have user approval for re-targeted ads, and that sensitive data is not used to target them. It also encourages publishers to ensure that advertisers follow the guidelines and that the industry collectively improves “the opt-out procedures so they are clear, consistent, and usable.”