Canadians Who Downloaded The Tim Hortons App Had Their Movements 'Tracked & Recorded' Every Day

An investigation by the federal privacy commissioner in Canada has concluded that the Tim Hortons mobile app collected too much personal information about customers without their proper consent.

The report, published June 1, states that the coffee giant collected millions of its customers' location data on a daily basis, even when they weren't using the app.

The app used location data to infer where users lived, worked and whether they were travelling, generating an "event" every time an individual entered or left a Tim Hortons competitor, major event venue or their home or workplace.

In fact, according to the commissioner, "People who downloaded the Tim Hortons app had their movements tracked and recorded every few minutes of every day, even when their app was not open."

The joint investigation by federal and provincial privacy authorities found this to be in violation of Canadian privacy laws.

As many as 4 million Canadians are thought to be active users of the app, per CBC News.

The company says the data was used in a limited way to analyze trends. Like how their customers' movements changed during the COVID-19 pandemic, for example.

However, the report concluded that this "continual and vast" collection of data was not proportional to the benefits the company could have gained from doing so.

While the app did ask for permission to access a mobile device's geolocation functions, the investigation found that users were misled to believe this would only happen when the app was being used.

"In reality, the app tracked users as long as the device was on, continually collecting their location data," reads the report.

Tim Hortons stopped continually tracking location data in this way in 2020 when this investigation was launched by the Office of the Privacy Commissioner of Canada in conjunction with similar authorities in British Columbia, Quebec and Alberta.

However, the report says there are still issues to this day.

Due to Tim Hortons’ "vague and permissive" contract with an American third-party location services supplier, it is still possible that customers' "de-identified" location data has been sold.

If re-identified, which officials say is a "real risk," it can be used to infer where people live and work. It could also be used to deduce if they've visited medical clinics, their religious beliefs and sexual preferences, their political affiliations and more.

In response, the company has agreed to delete any remaining location data and ensure third-party services to the same, as well as establish and maintain a privacy management program and report the measures it has taken to comply.

In a statement shared with Narcity, Tim Hortons added, "We fully cooperated with the privacy commissioners of Canada, Alberta, British Columbia and Quebec in the course of their investigation and we’ve already begun work on implementing their recommendations."

The company reiterated that the report does not require changes to be made to the current Tim Hortons app and that the geolocation data in question was never used for targeted advertising purposes.

"Tim Hortons clearly crossed the line by amassing a huge amount of highly sensitive information about its customers," Canada's Privacy Commissioner Daniel Therrien said.

"Following people’s movements every few minutes of every day was clearly an inappropriate form of surveillance."

“This investigation sends a strong message to organizations that you can’t spy on your customers just because it fits in your marketing strategy," Michael McEvoy, Information and Privacy Commissioner for B.C., added.

This article’s cover image was used for illustrative purposes only.