Tim Hortons app tracked Canadians’ movement even when not in use: report

Tim Hortons is one of Canada's most beloved culinary institutions, serving Double-Doubles, TimBits, and freshly toasted bagels to millions across the nation.

What Canadians were not expecting was that the chain's app would be tracking their every move, but that's exactly what a new report from the Office of the Privacy Commissioner has revealed.

The report, released Wednesday, states that people who used the Tim Hortons app before 2020 "had their movements tracked and recorded every few minutes of every day, even when their app was not open."

According to the report, while the app did ask users for permission to access their phone's geolocation function, it "misled" them to believe the information would only be collected while the app was in use.

In reality, along with using location data to point users in the direction of the nearest Timmie's, the app collected such data "to infer where users lived, where they worked, and whether they were travelling."

The app reportedly "generated an 'event' every time users entered or left a Tim Hortons competitor, a major sports venue, or their home or workplace" in an attempt to "analyze user trends" for marketing purposes.

While the practice of continuously tracking users' locations was abandoned in 2020, the report states that the contract Tim Hortons had with a third party location services supplier was "so vague and permissive" that it could have allowed the company to sell "de-identified geolocation data," which could easily be re-identified.

Privacy authorities set out a list of recommendations Tim Hortons should follow, including deleting any remaining location data and establishing a proper privacy management program. The chain has agreed to implement the suggestions.

The news drew criticism from legislators and citizens alike.

"This investigation sends a strong message to organizations that you can't spy on your customers just because it fits in your marketing strategy," said Michael McEvoy, BC's Information and Privacy Commissioner. "Not only is this kind of collection of information a violation of the law, it is a complete breach of customers' trust. The good news in this case is that Tim Hortons has agreed to follow the recommendations we set out, and I hope other organizations can learn from the results of this investigation."