Alberta
Tim Hortons app violated privacy laws in collection of ‘vast amounts’ of sensitive location data
People who downloaded the Tim Hortons app had their movements tracked and recorded every few minutes of every day, even when their app was not open, in violation of Canadian privacy laws, a joint investigation by federal and provincial privacy authorities has found.
The investigation concluded that Tim Hortons’ continual and vast collection of location information was not proportional to the benefits Tim Hortons may have hoped to gain from better targeted promotion of its coffee and other products.
The Office of the Privacy Commissioner of Canada, Commission d’accès à l’information du Québec, Office of the Information and Privacy Commissioner for British Columbia, and Office of the Information and Privacy Commissioner of Alberta issued their Report of Findings today.
The Tim Hortons app asked for permission to access the mobile device’s geolocation functions, but misled many users to believe information would only be accessed when the app was in use. In reality, the app tracked users as long as the device was on, continually collecting their location data.
The app also used location data to infer where users lived, where they worked, and whether they were travelling. It generated an “event” every time users entered or left a Tim Hortons competitor, a major sports venue, or their home or workplace.
The investigation uncovered that Tim Hortons continued to collect vast amounts of location data for a year after shelving plans to use it for targeted advertising, even though it had no legitimate need to do so.
The company says it only used aggregated location data in a limited way, to analyze user trends – for example, whether users switched to other coffee chains, and how users’ movements changed as the pandemic took hold.
While Tim Hortons stopped continually tracking users’ location in 2020, after the investigation was launched, that decision did not eliminate the risk of surveillance. The investigation found that Tim Hortons’ contract with an American third-party location services supplier contained language so vague and permissive that it would have allowed the company to sell “de-identified” location data for its own purposes.
There is a real risk that de-identified geolocation data could be re-identified. A research report by the Office of the Privacy Commissioner of Canada underscored how easily people can be identified by their movements.
Location data is highly sensitive because it can be used to infer where people live and work, reveal trips to medical clinics. It can be used to make deductions about religious beliefs, sexual preferences, social political affiliations and more.
Organizations must implement robust contractual safeguards to limit service providers’ use and disclosure of their app users’ information, including in de-identified form. Failure to do so could put those users at risk of having their data used by data aggregators in ways they never envisioned, including for detailed profiling.
The investigation also revealed that Tim Hortons lacked a robust privacy management program for the app, which would have allowed the company to identify and address many of the privacy contraventions the investigation found.
The four privacy authorities recommended that Tim Hortons:
- Delete any remaining location data and direct third-party service providers to do the same;
- Establish and maintain a privacy management program that: includes privacy impact assessments for the app and any other apps it launches; creates a process to ensure information collection is necessary and proportional to the privacy impacts identified; ensures that privacy communications are consistent with, and adequately explain app-related practices; and
- Report back with the details of measures it has taken to comply with the recommendations.
Tim Hortons agreed to implement the recommendations.
QUOTES
“Tim Hortons clearly crossed the line by amassing a huge amount of highly sensitive information about its customers. Following people’s movements every few minutes of every day was clearly an inappropriate form of surveillance. This case once again highlights the harms that can result from poorly designed technologies as well as the need for strong privacy laws to protect the rights of Canadians.”
“This report eloquently illustrates the risks inherent in the use of geolocation and the importance of transparent and accountable privacy practices. Without a suitable prior assessment, Tim Hortons collected sensitive information about its customers through its app, without their adequate knowledge or consent. It is to put an end to this kind of practice that Quebec has reviewed its legislation protecting personal information giving more powers to the Commission and making companies more accountable. ”
“This investigation sends a strong message to organizations that you can’t spy on your customers just because it fits in your marketing strategy. Not only is this kind of collection of information a violation of the law, it is a complete breach of customers’ trust. The good news in this case is that Tim Hortons has agreed to follow the recommendations we set out, and I hope other organizations can learn from the results of this investigation.”
“This investigation is yet another example where an organization has not effectively notified customers about its practices. Tim Hortons’ customers did not have adequate information to consent to the location tracking that was actually occurring. When people download and use these types of apps, it’s important that they know in advance what will happen to their personal information and that organizations follow through with their commitments.”
Alberta
Alberta Provincial Police – New chief of Independent Agency Police Service

Sat Parhar has been appointed as the first chief of the Independent Agency Police Service, marking the next step toward a new municipal policing option.
The appointment of a new chief for the Independent Agency Police Service (IAPS) marks the next step in giving municipalities a new option for local policing and builds on the work already underway for the agency to assume the police-like duties currently carried out by the Alberta Sheriffs. The IAPS will empower municipalities to adopt strategies that effectively respond to their specific safety concerns, enhancing public safety across the province.
Chief Parhar brings more than 25 years of policing experience, including senior roles with the Calgary Police Service, most recently as deputy chief. His frontline policing experience and deep understanding of Alberta’s complex and diverse public safety landscape positions him to lead the agency as it takes shape and begins its work as a new municipal policing option, keeping communities safe.
Once operational, the agency will strengthen Alberta’s existing policing model and complement the province’s current police services, which includes the RCMP, Indigenous policing services and municipal police. It will help fill gaps and ensure law enforcement resources are deployed efficiently to meet Alberta’s evolving public safety needs and improve law enforcement response times, particularly in rural communities.
“Appointing Chief Sat Parhar is a key milestone in Alberta’s plan to give municipalities a real choice in how their communities are kept safe. This is about building a modern police service that reflects the priorities of Albertans, strengthens local decision-making, and ensures every corner of our province, especially rural areas, can count on responsive, effective law enforcement. With his decades of experience and deep understanding of Alberta’s policing landscape, he is the right leader to bring this vision to life.”
“This appointment signifies a significant step forward in our efforts to establish a more robust, community-focused policing model that is better equipped to meet the unique needs of our local residents. Under Chief Parhar’s visionary leadership, we are confident that we will develop a modern, efficient police service that not only enhances public safety but also aligns closely with the priorities and values of Albertans. His experience and commitment are vital in shaping an IAPS that is responsive, transparent, and dedicated to fostering trust and collaboration within the community, ultimately ensuring a safer and more connected society for all.”
Chief Parhar’s immediate priorities will be to hire an executive team and commence organizational planning such as developing key recruitment, training and other operational policies. Chief Parhar’s appointment is the first step of many to establishing the IAPS.
“It’s an honour to take on this role and help shape a modern police service built for Alberta. My focus from day one will be on setting high standards for professionalism, building strong relationships with our partners and ensuring this service reflects the needs and priorities of the communities we serve.”
The Independent Agency Police Service was formally created through regulation following the passing of Public Safety Statutes Amendment Act, 2024. The agency will operate as an independent Crown corporation, and will be renamed the Alberta Sheriffs Police Service, with its head office located in Calgary. The IAPS will be operationally independent from the provincial government with civilian oversight, consistent with all police services in Alberta.
“When it comes to policing, municipalities like ours deserve a choice – especially when the current system leaves us disadvantaged simply because of our size. We look forward to learning more about what that alternative will look like once an Alberta police agency is fully established and the options are clear. For us, this is about fairness, sustainability, and ensuring municipalities have access to policing solutions that reflect both their needs and their realities.”
Quick facts
- The regulation establishes the IAPS Provincial Corporation and its governance structure including board of directors, board of director powers, financial responsibilities and accountabilities.
Related news
- Expanding municipal police service options (April 7, 2024)
Alberta
Pierre Poilievre – Per Capita, Hardisty, Alberta Is the Most Important Little Town In Canada

From Pierre Poilievre
-
Business18 hours ago
RFK Jr. says Hep B vaccine is linked to 1,135% higher autism rate
-
Alberta1 day ago
Alberta Independence Seekers Take First Step: Citizen Initiative Application Approved, Notice of Initiative Petition Issued
-
Crime1 day ago
National Health Care Fraud Takedown Results in 324 Defendants Charged in Connection with Over $14.6 Billion in Alleged Fraud
-
Health1 day ago
RFK Jr. Unloads Disturbing Vaccine Secrets on Tucker—And Surprises Everyone on Trump
-
Censorship Industrial Complex1 day ago
Global media alliance colluded with foreign nations to crush free speech in America: House report
-
Bruce Dowbiggin1 day ago
The Game That Let Canadians Forgive The Liberals — Again
-
Alberta4 hours ago
Alberta Provincial Police – New chief of Independent Agency Police Service
-
International8 hours ago
CBS settles with Trump over doctored 60 Minutes Harris interview