Tim Hortons app collects user data without consent

❗Article Status Notice: This Article is a stub

---

This article is underdeveloped, and needs additional work to meet the wiki's Content Guidelines and be in line with our Mission Statement for comprehensive coverage of consumer protection issues. Learn more ▼

Issues may include:

• This article needs to be expanded to provide meaningful information
• This article requires additional verifiable evidence to demonstrate systemic impact
• More documentation is needed to establish how this reflects broader consumer protection concerns
• The connection between individual incidents and company-wide practices needs to be better established
• The article is simply too short, and lacks sufficient content

How you can help:

• Add documented examples with verifiable sources
• Provide evidence of similar incidents affecting other consumers
• Include relevant company policies or communications that demonstrate systemic practices
• Link to credible reporting that covers these issues
• Flesh out the article with relevant information

This notice will be removed once the article is sufficiently developed. Once you believe the article is ready to have its notice removed, please visit the Moderator's noticeboard, or the Discord (join here) and post to the #appeals channel, or mention its status on the article's talk page.

⚠️ A deletion request has been made for this article

There has been a deletion request for this page for the following reason:

Only a few sentences, no NPOV, no inline references.

---

This request will be reviewed and acted upon by the wiki moderation team within one week of the template being added.

To appeal this deletion request, please make an entry at the Moderator's noticeboard.

Do not delete this page before removing all references to it:

• Tim Hortons (← links | edit)
• Projects:Archive everything (← links | edit)

Background

In June of 2022, reports in Canada went viral regarding the Tim Hortons Android app which was collecting personal information from users phones without consent. Tim Hortons used a third-party service, Radar, to collect geolocation data of users. it is alleged that they stopped this practice in August of 2020. One of the pieces of data reported back to the Tim Hortons servers included information about when a person with this app on their phone was visiting a competitor coffee shop.

Tim Hortons app tracked too much personal information without adequate consent (May 2019)

Starting in in May 2019 Tim Hortons released updated versions of its App so that it could, with assistance from a US third-party service provider (“Radar”), track and collect the location of Users’ devices.

In August 2020, subsequent to notification of investigation by the Office of the Privacy Commissioner of Canada, Tim Hortons permanently ceased collecting granular location data, via the App, for purposes of targeted advertising.

Investigation Report by the Office of the Privacy Commissioner of Canada (June 1, 2022)

The finding from the investigation are as follows:

• Tim Hortons did not collect or use personal information for appropriate purposes in the circumstances

• Tim Hortons did not obtain valid consent, as would have been required for its collection and use of the Radar Location Data through the App had we found Tim Hortons to have had an appropriate purpose.

During the course of the Investigation two additional concerns were identified:

• The contractual protections Tim Hortons implemented to protect Users’ personal information while being processed by a third-party service provider.

• Accountability, and Tim Hortons’ apparent failure to implement policies and practices to ensure compliance with the Acts.

Tim Hortons' response post investigation

Deletion: [Tim Hortons] agreed to comply with the recommendation detailed in paragraph 90 within one (1) month of the lifting of any relevant litigation holds, which currently prevents [Tim Hortons] from deleting, or effecting deletion, of the data in question, following a final disposition of the matters underlying the litigation holds. In the interim, [Tim Hortons] will not use the data for any purpose other than in relation to the associated litigation. [Tim Hortons] will inform our Offices in writing of its compliance with this commitment within 14 days of completing the required deletions, including with a detailed description of the data deleted by [Tim Hortons] and that deleted by its third-party service providers.

Privacy Management Program: [Tim Hortons] agreed to comply with the recommendations detailed in paragraph 91 and 92 within twelve (12) months of the issuance of this report of findings, noting the effort and resources that would be required to implement such a program. [Tim Hortons] further agreed to provide quarterly written updates to our Offices detailing work completed, and progress to completion, on development and implementation of the privacy management program to date.

Class action lawsuits

Restaurant Brands International Inc., the parent company of Tim Hortons, is facing several class-action lawsuits in relation to its mobile app.

The lawsuits were launched after the Financial Post's reporting on the collection of geolocation data.

See also

Main page[https://www.priv.gc.ca/en/opc-news/news-and-announcements/2022/nr-c_220601/][https://uwaterloo.ca/cybersecurity-privacy-institute/news/tim-hortons-app-violated-privacy-laws-after-collecting]

References

Add a category with the same name as the product, service, website, software, product line or company that this article is about.

The "Incidents" category is not needed.

---

Add your text below this box. Once this section is complete, delete this box by clicking on it and pressing backspace.