AI-generated illustration; not a photograph of the reported event.
- calendar_today November 13, 2026
Marketplace Investigates User Data Collection in Popular Apps
A recent Marketplace investigation has revealed the far-reaching scope of data collection practices among six popular mobile apps used in Canada: Tim Hortons, PC Optimum, The Weather Network, Facebook, Amazon, and YouTube. The findings show that these apps gather and sometimes share more personal and device data than many users might expect, raising significant concerns about mobile app privacy, data sharing, and user data security.
Methodology: How Data Collection Was Tested
To uncover what information these apps collect and share, Joel Reardon, associate professor at the University of Calgary, and his research team scanned network traffic on an Android device. The organization Privo, which assesses apps for U.S. child privacy law compliance, conducted similar scans on iOS devices. Their analyses focused on network activity and explicit app disclosures regarding data practices.
Tim Hortons: Extensive Device Data Sent to Third Parties
The Tim Hortons app was found to be transmitting significant data to third-party companies as soon as it launched. Information such as the device name, unique identifiers, lists of device sensors, camera specifications, ringtones, and the names of nearby Wi-Fi routers—information that can be used for location tracking—was observed being sent. One third-party, identified as a fraud protection service, received enough data to build a unique digital fingerprint for each device. The amount of data collected led experts to describe these practices as excessive for validating a basic transaction like buying a cup of coffee.
Tim Hortons’ director of communications stated that this data collection supports fraud prevention and account protection, asserting that personal data is not sold or used for marketing.
PC Optimum: Data Shared with Numerous Outside Companies
PC Optimum was observed sending information regarding user searches, including sensitive products, to up to ten outside companies. In some cases, third parties received precise location data, unique identifiers, first names, unredacted email addresses, and account numbers, as well as detailed user interactions with the app. Experts questioned the necessity of such extensive data sharing. Loblaw, the app’s parent company, responded that data collection supports routine features, and that personal data is never sold.
The Weather Network: Location Data Used for Targeted Advertising
When granted access to a user’s location, The Weather Network app sent precise location, local weather, and device advertising IDs to third-party companies for targeted advertising. These device identifiers allow companies to track location history. Pelmorex, the parent company, stated the data is not sold, is used only when users allow it, and supports core services like providing local weather and relevant ads.
Facebook, Amazon, and YouTube: Data Collection Without Third-Party Sharing
The scans showed that while Facebook collected metadata from images and videos on user devices and tracked in-app behavior, it did not appear to share this information externally. Amazon collected user searches and device advertising IDs, but similarly kept data internal. YouTube data flowed only to servers in the United States, with no evidence of third-party sharing. Neither Facebook nor Amazon reported selling users' personal data, and YouTube followed guidelines restricting targeted advertising during children’s content viewing.
Expert Concerns: Limits of User Control and Privacy Laws
Former Ontario privacy commissioner Ann Cavoukian expressed concern that current Canadian privacy laws do not provide sufficient user protection against broad data collection and sharing. She encouraged companies to minimize data collection, retain only necessary data, and delete it when no longer needed. Government officials noted that new legislation, Bill C-36, aims to strengthen transparency and control over personal data, but it remains under consideration in parliament.
Protecting Personal Data: Practical Steps for Users
Privacy experts advise users to question what data is collected and why, and to request deletion when appropriate. Given the difficulty of fully controlling data transmission within apps and their embedded third parties, experts recommend regularly deleting unused apps and limiting the apps kept on devices as a form of data protection.
Source: cbc.ca.
