Six of the most popular apps in Canada collect and pass along more data than many people would expect, a CBC Marketplace investigation published Friday found. Marketplace had University of Calgary computer science professor Joel Reardon and his team scan the apps’ network traffic on Android, and Privo, an organization that checks apps against U.S. children’s privacy law, scan them on iOS. Each app discloses its data collection in its terms; the question the researchers raised is whether they collect more than they need.
What the scans found
| App | What the scan appeared to show | What the company says |
|---|---|---|
| Tim Hortons | Data sent to third parties as soon as the app opens, including enough device detail (down to camera specs and nearby Wi-Fi network names) for an overseas company to “fingerprint” the phone | It’s a fraud-prevention service, not used for marketing; the data isn’t sold |
| PC Optimum | Product searches, including sensitive ones like prenatal vitamins, sent to 10 outside companies; one received location and a device ID | Loblaw has never sold personal information; data supports features like online shopping and store finding |
| Weather Network | With location turned on, location and a device ID sent to a third party for targeted ads | It doesn’t sell user data; location is optional and you can get the weather without it |
| When you share one photo, metadata of other photos on the phone collected; location of posted photos; every scroll tracked | Meta didn’t comment; its policy says it doesn’t sell data | |
| Amazon | Searches, including sensitive ones, collected with the advertising ID; no third-party sharing seen | It never sells customer data |
| YouTube | No third-party sharing seen; no targeted ads on a children’s video | Google doesn’t sell personal information |
The federal privacy commissioner’s office told Marketplace the findings raise “a number of concerns.” Ottawa’s privacy bill, C-36, which would give people more control over their data, is still before the House of Commons.
What you can do
The researchers’ main advice: delete apps you don’t use. Apps and the third-party code built into them can send data even when you’re not actively using them. Beyond that, a few settings limit what apps can tie back to you.
On iPhone: go to Settings > Privacy & Security > Tracking and turn off Allow Apps to Request to Track. Every app is then treated as if you’d tapped “Ask App Not to Track,” which blocks access to your phone’s advertising identifier, according to Apple. You can still use the apps normally.
On Android: your advertising ID can be reset or deleted, Google says; look under Ads in your phone’s privacy settings. Then review location access in Settings > Location > App location permissions: switch apps to Allow only while using the app or Don’t allow, and turn off Use precise location for anything that doesn’t need it, per Google’s help page.
On both: don’t grant photo access to your whole library when sharing one picture, and skip location for weather and shopping apps; the Weather Network says its app works without it.
Why it matters: Loyalty and coffee apps are on millions of Canadian phones, and most people never read the terms. You can’t stop every transfer, but the tracking and location settings above take two minutes and cut off the identifiers that let companies link your activity across apps.
