Tim Hortons app collects user data without consent

⚠️ Article status notice: This article has been marked as incomplete

This article needs additional work for its sourcing and verifiability to meet the wiki's Content Guidelines and be in line with our Mission Statement for comprehensive coverage of consumer protection issues.

This notice will be removed once sufficient documentation has been added to establish the systemic nature of these issues. Once you believe the article is ready to have its notice removed, please visit the Moderator's noticeboard, or the discord and post to the #appeals channel.

Learn more ▼

This Article Requires Additional Verification

---

This article has been flagged due to verification concerns. While the topic might have merit, the claims presented lack citations that live up to our standards, or rely on sources that are questionable or unverifiable by our standards. Articles must meet the Moderator Guidelines and Mission statement; factual accuracy and systemic relevance are required for inclusion here!

Why This Article Is In Question

---

Articles in this wiki are required to:

• Provide verifiable & credible evidence to substantiate claims.
• Avoid relying on anecdotal, unsourced, or suspicious citations that lack legitimacy.
• Make sure that all claims are backed by reliable documentation or reporting from reputable sources.

Examples of issues that trigger this notice:

• A topic that heavily relies on forum posts, personal blogs, or other unverifiable sources.
• Unsupported claims with no evidence or citations to back them up.
• Citations to disreputable sources, like non-expert blogs or sites known for spreading misinformation.

How You Can Improve This Article

---

To address verification concerns:

• Replace or supplement weak citations with credible, verifiable sources.
• Make sure that claims are backed by reputable reporting or independent documentation.
• Provide additional evidence to demonstrate systemic relevance and factual accuracy. For example:
  • Avoid: Claims based entirely on personal anecdotes or hearsay without supporting documentation.
  • Include: Corporate policies, internal communications, receipts, repair logs, verifiable video evidence, or credible investigative reports.

If you believe this notice has been placed in error, or once the article has been updated to address these concerns, please visit the Moderator's noticeboard, or the #appeals channel on our Discord server: Join here.

Background

In June of 2022, reports in Canada went viral regarding the Tim Hortons Android app which was collecting personal information from users phones without consent. Tim Hortons used a third-party service, Radar, to collect geolocation data of users. it is alleged that they stopped this practice in August of 2020. One of the pieces of data reported back to the Tim Hortons servers included information about when a person with this app on their phone was visiting a competitor coffee shop.

Tim Hortons app tracked too much personal information without adequate consent (May 2019)

Starting in in May 2019 Tim Hortons released updated versions of its App so that it could, with assistance from a US third-party service provider (“Radar”), track and collect the location of Users’ devices.

In August 2020, subsequent to notification of investigation by the Office of the Privacy Commissioner of Canada, Tim Hortons permanently ceased collecting granular location data, via the App, for purposes of targeted advertising.

Investigation Report by the Office of the Privacy Commissioner of Canada (June 1, 2022)

The finding from the investigation are as follows:

• Tim Hortons did not collect or use personal information for appropriate purposes in the circumstances

• Tim Hortons did not obtain valid consent, as would have been required for its collection and use of the Radar Location Data through the App had we found Tim Hortons to have had an appropriate purpose.

During the course of the Investigation two additional concerns were identified:

• The contractual protections Tim Hortons implemented to protect Users’ personal information while being processed by a third-party service provider.

• Accountability, and Tim Hortons’ apparent failure to implement policies and practices to ensure compliance with the Acts.

Tim Hortons' response post investigation

Deletion: [Tim Hortons] agreed to comply with the recommendation detailed in paragraph 90 within one (1) month of the lifting of any relevant litigation holds, which currently prevents [Tim Hortons] from deleting, or effecting deletion, of the data in question, following a final disposition of the matters underlying the litigation holds. In the interim, [Tim Hortons] will not use the data for any purpose other than in relation to the associated litigation. [Tim Hortons] will inform our Offices in writing of its compliance with this commitment within 14 days of completing the required deletions, including with a detailed description of the data deleted by [Tim Hortons] and that deleted by its third-party service providers.

Privacy Management Program: [Tim Hortons] agreed to comply with the recommendations detailed in paragraph 91 and 92 within twelve (12) months of the issuance of this report of findings, noting the effort and resources that would be required to implement such a program. [Tim Hortons] further agreed to provide quarterly written updates to our Offices detailing work completed, and progress to completion, on development and implementation of the privacy management program to date.

Class action lawsuits

Restaurant Brands International Inc., the parent company of Tim Hortons, is facing several class-action lawsuits in relation to its mobile app.

The lawsuits were launched after the Financial Post's reporting on the collection of geolocation data.

See also

• https://www.priv.gc.ca/en/opc-news/news-and-announcements/2022/nr-c_220601/
• https://uwaterloo.ca/cybersecurity-privacy-institute/news/tim-hortons-app-violated-privacy-laws-after-collecting