Tim Hortons' app tracked users' every move — privacy findings, class actions

Tim Hortons' mobile loyalty app asked users for permission to use their location, telling them the data would help target promotions. Instead, the app used a third-party provider, Radar, to record users' movements every few minutes of every day — even when the app was closed and even after a user turned location off. It inferred where users lived and worked and logged every time they entered a competitor, a sports venue or their home.

The company had shelved its plans for targeted advertising but kept collecting the data for about a year afterwards, with no legitimate need. Reporting by the Financial Post first exposed the tracking, and a joint investigation by the federal privacy commissioner with authorities in British Columbia, Quebec and Alberta concluded in June 2022 that the collection violated Canadian privacy law — a 'loss of Users' privacy that was not proportional to the potential benefits' Tim Hortons hoped to gain.

The commissioners found the contract with Radar was so vague that the provider could have sold 'de-identified' location data, which carries a re-identification risk. Tim Hortons agreed to delete all remaining location data, require its providers to do the same, and build a proper privacy management program. Its parent, Restaurant Brands International, also faced nationwide class-action lawsuits over the tracking.