23 ms·

Tim Hortons app violated laws in collection of ‘vast amounts’ of location data

700 points by danso 4y ago

Karawebnetwork 4y ago
5M+ downloads according to Play Store. More on Apple.
juice_bus 4y ago
> The app also used location data to infer where users lived, where they worked, and whether they were travelling. It generated an “event” every time users entered or left a Tim Hortons competitor, a major sports venue, or their home or workplace. yikes
- deleted 4y ago
  [deleted]
skipants 4y ago
>Consistent with this explanation, our Offices confirmed that the SDK tracked, as Events, home, office, geofenced locations (including its competitors), and travel in and out of Canada. For example, news articles had noted that an event was recorded with computer code such as “user.entered.place” with “place.name”: “Rogers Centre”, or “user.entered.office”.Footnote 16 Using open-source resources and tools, the investigative team’s technology analysts determined that the SDK programming code included the following: USER_ENTERED_HOME; USER_EXITED_HOME; USER_ENTERED_OFFICE; USER_EXITED_OFFICE; USER_STARTED_TRAVELING; USER_STOPPED_TRAVELING; and USER_ENTERED_GEOFENCE; USER_EXITED_GEOFENCE. This is just downright appalling.
- Gak2 4y ago
  quick google search... looks like the LiveShopper SDK
- deleted 4y ago
  [deleted]
davidkuennen 4y ago
Crazy. I suppose they stopped after Google and Apple tightened their rules in 2020 regarding location tracking and not because of a change of heart.
- LegitShady 4y ago
  they don't say exactly when and why they disabled the tracking except "in 2020", but in june 2020 when the original expose on their trackign appeared in the Financial Post, tims had no plans to disable the tracking, just to edit their privacy and other policy texts so that it wasn't outright them lying. https://financialpost.com/technology/tim-hortons-app-tracking-customers-intimate-data https://financialpost.com/technology/tim-hortons-app-trackin... There is the above privacy investigation but also a bunch of class action lawsuits filed in multiple provinces.
curt15 4y ago
This is why I always use a retail store's mobile website and never download their "app". The browser sandbox saves me from having to worry about these shenangians.
- travisporter 4y ago
  How do the apple app clips work in this regard? Can they collect location info?
  - hooksfordays 4y ago
    According to Apple’s support site[0] App Clips can request your location, and permission’s automatically revoked after 1 day, and only works while the apple clip is in use. So, better in theory. [0] https://support.apple.com/en-us/HT212238 https://support.apple.com/en-us/HT212238
  - mikestew 4y ago
    Because there is a setting for it, I assume that app clips can request location info. I have to assume, as there apparently is no app clip that has ever requested such. Come to think of it, I don't know that I've used an app clip. But the setting is there.
- switchbak 4y ago
  I assume that at least one of the apps I have is probably sharing all my data right now. Be it the flashlight or the guitar tuner, or that menu planner thing. I remember a time when app developers weren't the user's enemy, but that was a long time ago.
- Fauntleroy 4y ago
  ...until they decide they'll make more money by forcing mobile users to use the app and start kneecapping the mobile web experience left and right. We need strict regulation for this or it'll never end.
- mikepurvis 4y ago
  A&W is so disorganized that they have a mobile app for placing orders at nearby restaurants, but to get coupons, you go to a separate awcoupon.ca website. The coupons are quite worthwhile, often 30-40% off the sticker price for common meal deals, but it's baffling that it wouldn't be integrated into the main app.
version_five 4y ago
I assume every app that has location permission does this. I can't imagine google doesn't, or the phone company. I don't think it's right (and even less right that apparently google will provide this information to law enforcement). I just think the only practical thing to do is assume you are being tracked and don't install apps unless you're ok with the tradeoff. The flip side of this, is why would I ever install a Tim Hortons app, why do I think they are offering an app, and what possible meaningful benefit (even assuming I went there regularly) would I drive from having an app?
- davidkuennen 4y ago
  Most store apps I know offer some kind of discount or membership program with points if they use the app. I guess something like that.
  - monkeybutton 4y ago
    Afaik they made Roll Up The Rim digital and in-app only because of covid.
    - ChoGGi 4y ago
      I used their website for rolling up, worked mostly alright.
- Li7h 4y ago
  Smart assumption to make. On the flip side, people install the app because they usually are how the rewards programs are implemented now. From the app page: Mobile Order & Pay Select and customize your favourite food and drinks, choose your preferred Tim Hortons location, and pay from the app. It’s now that easy to order your favourite Tim Hortons items from your phone. Personalized Menu Add recently ordered items with one tap. Customized orders are saved on your menu so you can get your order just the way you like it. Tims® Rewards After just seven eligible purchases, receive your choice of a FREE coffee, tea or baked good. Keep checking for more special offers to come. It’s time to reward your routine! Scan for Tims® Rewards A digital version of your loyalty card that you can scan easily when ordering in the restaurant – never miss an opportunity to earn rewards. Scan to Pay Save time and pay for your order right from the app -- no need to carry cash or a credit card! Take Out, Dine In or Drive Thru Choose your pick-up method. Payment is completed in-app, so you can grab your order to go, or dine in with us. Your choice.
revolvingocelot 4y ago
>“This investigation sends a strong message to organizations that you can’t spy on your customers just because it fits in your marketing strategy. Not only is this kind of collection of information a violation of the law, it is a complete breach of customers’ trust. The good news in this case is that Tim Hortons has agreed to follow the recommendations we set out, and I hope other organizations can learn from the results of this investigation.” – Michael McEvoy, Information and Privacy Commissioner for British Columbia Insane that there isn't any more forceful enforcement for "a violation of the law" than setting out "recommendations" and trusting that the guys under investigation for "violation" of the, presumably, privacy "law" will implement it.
- airstrike 4y ago
  You'd need a lawsuit for that. The investigation FTA was by "privacy agencies" which have no ability to enforce anything more severe than recommendations
  - deleted 4y ago
    [deleted]
  - revolvingocelot 4y ago
    I actually did read the article; I even grabbed a quote from it! Still, the governmental privacy authorities suggest that the law was broken; I'm aware that they aren't enforcement, because I read the article, but the language is pretty clear that they think these actions broke the law. >You'd need a lawsuit for that Can you elaborate? Is there Canadian privacy law being violated here that doesn't stipulate any penalty other than exposing Tim Hortons to private lawsuits? Forgive the directness of my question, your comment reads like you'd know. edit: reading the Report of Findings [0] on the page itself suggests that because the violations ceased once, er, the violating entity had been informed of the investigation and had suggested that it'd delete the harvested data, the joint investigation "therefore found this matter to be well-founded and conditionally resolved". So, nobody really cares [0] https://www.priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-into-businesses/2022/pipeda-2022-001/ https://www.priv.gc.ca/en/opc-actions-and-decisions/investig...
sitkack 4y ago
The fact that was labeled just means that they were inferring it on the client. Given any location stream from a person and POI data you can infer all of this stuff, including if they have kids, a mistress, if they are gay or straight, if they are religious, friends, age, sex, nationality. I think Tim Hortons should be required to analyze and publish the data from questions supplied by the public. What is the likelihood that I will have to visit a bathroom within X minutes after consuming a Tim Hortons? Visit a hospital? Get in a car crash? What percentage of Tim Hortons customers also visit strip clubs? What is the average waiting time in line for a TH visitor? Thoughts?
rfwhyte 4y ago
Wildly disappointing that this massive, and blatantly illegal collection of user location data has (of course) merely resulted in a slap on the wrist for the perpetrators here. There should be huge (multi millions) fines and probably even jail time for the execs who approved / managed this app, but as per usual our corporate overlords get off with a "Stern warning" and a promise not to do it again.
- gralx 4y ago
  On the face of it, no politician wants to risk tanking an org that employs a significant part of their jurisdiction. Providing even minimum wage employment to thousands is an objective public good and hard to do, even for scoundrels. Big employers are not above the law, but they sure get more leeway.
  - cardy31 4y ago
    Honestly with Tim Hortons I bet the number of voters working there are quite small. They are one of the biggest users of the Temporary Foreign Worker program in Canada. Many locations are full of foreign workers. Some of these are students, some are from the program, but either way they largely aren’t voters.
blorenz 4y ago
I recently attended an automotive dealership conference where I was being pitched for a product that would let me know if my customers were at rival dealerships. I poked and prodded to understand if these were legitimate claims or just marketing hype. They revealed that they purchased location data from app developers. I was shocked and surprised -- I don't know why I was because this should have been expected. It really enlightened me on the exploitation and misuse of data by crappy apps.
- sitkack 4y ago
  Not just app data, but you can also purchase celltower data, https://airsage.com/ https://airsage.com/ It is easy to fuse with other sources.
- roywiggins 4y ago
  This investigation from a couple years ago in the NYT was pretty good: https://www.nytimes.com/interactive/2019/12/19/opinion/location-tracking-cell-phone.html https://www.nytimes.com/interactive/2019/12/19/opinion/locat...
  - jonhohle 4y ago
    It’s funny that when the story is about their political allies, that data becomes much less concerning: > “It’s really, really hard to assign even what side of the street you’re on when you’re using this kind of data,” said Paul Schmitt, a research scientist and professor at the University of Southern California. https://www.nytimes.com/2022/05/29/us/politics/2000-mules-trump-conspiracy-theory.html https://www.nytimes.com/2022/05/29/us/politics/2000-mules-tr...
    - neuronexmachina 4y ago
      Looking at the preceding paragraphs, I'm not sure I understand what point you're trying to make: > Mr. Phillips and Ms. Engelbrecht’s case is largely built on cellphone data. A report created by the group includes an appendix that claims to list “IMEI” numbers of the tracked devices — 15-digit codes unique to each cellphone. But each entry on the list is a 20-character string of numbers and letters followed by a lot of x’s. Mr. Phillips said new IDs had been created “to obfuscate the numbers.” >"The same report says the group “purchased 25 terabytes of cellphone signal data emitted by devices” in the Milwaukee area in a two-week period before the 2020 election. They claim to have isolated 107 unique devices that made “20 or more visits to drop boxes” and “multiple visits to nongovernmental organizations” that were involved in get out the vote efforts. >A number of researchers have said that while cellphone data is fairly precise, it cannot determine if someone is depositing ballots in a drop box or just passing by the area. >“It’s really, really hard to assign even what side of the street you’re on when you’re using this kind of data,” said Paul Schmitt, a research scientist and professor at the University of Southern California.
gjsman-1000 4y ago
Uh huh - if I am Tim Hortons, the slap of the wrist was just the price of this valuable information and the insights retrieved from it.
- thfuran 4y ago
  And it was a steal.
UI_at_80x24 4y ago
For those of you who don't know who/what "Tim Horton's" is allow me to educate and enlighten. https://en.wikipedia.org/wiki/Tim_Hortons https://en.wikipedia.org/wiki/Tim_Hortons It's a 'fast food/coffee' chain that really was made popular by a recurring skit on a TV show called: Royal Canadian Air Farce (Sketch based usually heavy on the political satire) The skit had 3 people sitting around a table drinking coffee and cracking jokes about current-events and mostly political fiascos. It was this lampooning of 'typical Canadian behaviour' of art imitating life that caused more people to show up and start hanging out at the corner coffee shop. In my small home town (40,000 people) there were maybe 3 shops (aka Timmies). During this boom to it's popularity that number increased by atleast 10. They made their doughnuts in-house every morning, and the coffee was tolerated as being acceptable. As the franchise grew in popularity it became something of a joke and expectation that a person could find a Timmies on nearly every block, and you would never need to drive more then 10 minutes to get to the closest one. Throughout it's financial hardships and ownership changes there has been a lot of complaints that "The coffee isn't as good as it used to be." And rumours that McDonalds (with it's McCafee push) bought Timmies old supplier of beans. Now the food is no longer made in store, and my impression is that the coffee is worse. There have been other cost-cutting measures like making the popular contest "Roll up the Rim" (where a person could unroll the lip of the cup of coffee to reveal a prize from free confections, to money and a car); becoming an APP-only prize (more like a lottery style jackpot then a winning cup). In total, I am not surprised. Their quality has gone downhill, and the treatment of staff is horrendous.
- loceng 4y ago
  "becoming an APP-only prize (more like a lottery style jackpot then a winning cup)." Sooo they could track exactly where their customers were going?
- stewx 4y ago
  Also, the chain is named after its former NHL player founder, who died after crashing his car while drunk and on drugs.
  - UI_at_80x24 4y ago
cs702 4y ago
The industrial data-gathering complex is expanding into ever more ethically dubious, ever more ridiculously unjustifiable niches. For an instant, I thought the OP might be a link to a fake story in The Onion. I mean, it wouldn't be out of place there: "Fast-food chains collecting vast amounts of location data." And yet, no one is shocked.
micah63 4y ago
When Burger King "bought" Tim Hortons in 2014 (I believe this was a tax evasion effort by Burger King to leave US and "merge" with a Canadian food company), the whole experience went to pot. This was a Canadian institution. I won't even step foot in a Tims anymore, the food, the customer experience, the app, it's all junk.
- midasuni 4y ago
  Interesting. My first trip outside of Europe was my honeymoon in 2008 to Canada. Various tour guides told us that Tim Hortons (“Timmy’s”) was a Canadian institution. Since then I’ve travelled a fair bit in US cities and a little in Canada and the only real difference I can see is that Canada has a Tim Hortons on the corner.
  - Marsymars 4y ago
    I mean, I'd still call it a Canadian institution, but it's not good. > Since then I’ve travelled a fair bit in US cities and a little in Canada and the only real difference I can see is that Canada has a Tim Hortons on the corner. Depends where you go. There's probably more of a different cultural feel in Quebec and the Atlantic provinces. e.g. Café Olimpico is a Montreal institution that feels quintessentially Montreal. (And the US has places with very different cultural feels to each other - of places I've visited, Honolulu isn't very similar to Billings - but I'm less familiar with the US than Canada.)
    - midasuni 4y ago
      I was amazed by many things with our 3 weeks in Canada, including how cheap car hire for a massive (Ford escape) car was, how wide the roads were, how off road logging roads were But one thing that stuck with me was seeing things I’d only ever heard of in tv/movies - Wendy’s and Dairy Queen come to mind. But I’d heard of them. And of course Starbucks (which we had in the U.K.) Never heard of Tim Hortons though, which I guess shows the relative strength of a medic an cultural exports vs Canadian cultural exports.
    - 908B64B197 4y ago
lykahb 4y ago
Is there any other purpose of making an app other than surveillance and ads?
- indymike 4y ago
  In this case, taking an order from a consumer and collecting a payment comes to mind. Just because you have a useful app doesn't mean you have to sell the user's location data to make money, ESPECIALLY if you are ALREADY making money with the app.
  - gruez 4y ago
    > In this case, taking an order from a consumer and collecting a payment comes to mind. all of this can be done in a web app, including the payment (apple pay).
jordemort 4y ago
"Timbits? More like Timbots!"
midislack 4y ago
- autoexec 4y ago
  > So just stop installing stupid apps and you don't have to worry about issues like this. I agreed with you up until that last line. The problem is that this sort of invasive tracking isn't limited to the apps on your devices. The devices themselves are spying on you, and the lack of meaningful privacy protections leaves us vulnerable even if we left our cell phones sitting in lead lined boxes. Without installing any apps on our phones at all this kind of pervasive tracking data could be collected using bluetooth beacons, using cell phone tower data, using facial recognition technology, using license plate readers, using the GPS/OnStar systems in our cars or using radar systems that see through the walls of our homes. This isn't a problem our personal choices can solve. We only have the power to make choices that hurt us in different ways. We need real regulation and laws with many rows of very sharp teeth.
  - 2OEH8eoCRo0 4y ago
    What? You can't live like God Emperor Stallman smugly using your flip phone and eating toe jam?
  - midislack 4y ago
    The government likes all this tracking and spying. If you think you can rely on the government to cure this ill you're mistaken. It's still possible to live without a cell phone at all.
    - autoexec 4y ago
      > The government likes all this tracking and spying. I agree, and some companies like collecting it and enjoy being paid to hand it over to the state. I don't think that makes it impossible to outlaw this stuff, but it does make it much harder. We'll likely need a number of reforms around elections and bribery to get people in office who will represent our interests but however difficult they've made it so far (and they've been refining their techniques for centuries), it is still possible to elect a person of our choosing. > It's still possible to live without a cell phone at all. Not without considerable difficulty though. I put it off for about a decade or so after flip phones were replaced by smart phones until eventually my family insisted on my having one out of concern. They even bought the damned thing for me. I'm still conflicted about owning it. Even at that time it was growing more troublesome to function without one though since many businesses were offering services exclusively over their apps. Like I said though, not having a phone won't spare you. There is an ever-growing list of ways to collect and track your activity both online and offline which don't depend on cell phones or apps. Ultimately, we're either going to have to insist on the kind of regulations we need to be protected or we'll have to resign ourselves to abuses enabled by the data collection going on.
user3939382 4y ago
Slap on the wrist for willfully violating the privacy of a massive amount of people. Par for the course in the US as well. Yet try violating the Wiretap Act as an individual, even accidentally, and see how it works out for you. That difference in results between giant corporations and individuals should give you a strong clue about who the “justice” system works for.
- system16 4y ago
  I wouldn't say it's a slap on the wrist. It's not even a scolding. Tim Hortons was literally found guilty of spying on millions of Canadians, and the only consequence they face is that they have to stop doing it.
- autoexec 4y ago
  > That difference in results between giant corporations and individuals should give you a strong clue about who the “justice” system works for. It's not just the justice system either. It's also representation in government. We have research showing that the average citizen has effectively zero influence on public policy and that our government caters exclusively to corporations and a small number of extremely wealthy individuals. The only time the rest of us get something we something we want is when our interests just happen to align with the interests of the powerful. (see https://scholar.princeton.edu/sites/default/files/mgilens/files/gilens_and_page_2014_-testing_theories_of_american_politics.doc.pdf https://scholar.princeton.edu/sites/default/files/mgilens/fi...)
sharmin123 4y ago
DwnVoteHoneyPot 4y ago
> The Tim Hortons app asked for permission to access the mobile device’s geolocation functions, but misled many users to believe information would only be accessed when the app was in use. In reality, the app tracked users as long as the device was on, continually collecting their location data. How does this work on an iPhone? If in Location Services and I have app set as "While Using the App", I'm assuming it's not possible for Tim Horton's app to collect data "as long as devices was on". Did it somehow bypass these settings?
- LeoPanthera 4y ago
  That setting cannot be bypassed on iOS.
  - barbazoo 4y ago
    Can it be bypassed on Android? Until now I assumed "While using the app" means exactly that.
    - minsc_and_boo 4y ago
      No, it can't. Google reviews every Android app that is requesting special permission for background location access. Tim Hortons was doing this back prior to 2020 when Google started requiring approval.
  - brewdad 4y ago
    Does allowing Background Refresh trick iOS into thinking the app is in use?
    - ThePowerOfFuet 4y ago
      No. "In use" means displayed as the frontmost app on iOS.
- gnabgib 4y ago
  As others have noted the app works fine without location on. (Android also has "only when using App" settings) It does default full location access all the time which is where the problem starts. Sane defaults required.
evandale 4y ago
I'm reminded of the corporation taken to arbitration story yesterday. I'm curious if you would be able to get anything from Tim Hortons if you did that.
octobus2021 4y ago
I'm against companies tracking my whereabouts and wanting to know everything about my personal life. However. Here's what the "charges" are as per the statement: >The investigation concluded that Tim Hortons’ continual and vast collection of location information was not proportional to the benefits Tim Hortons may have hoped to gain from better targeted promotion of its coffee and other products. So it's obviously ok for a business to collect information. This includes information _legally_ collected from customers' phones (I'm sure everybody just clicks OK agreeing to the terms when installing the app). So what's the issue? That the amount is "vast"? That it's "continuous"? That it's "not proportional to the benefits"? Who decides what's vast and what's not, what's proportional and what's not? I'm really not getting what they're being accused of doing. They got a lot of data and had no clue what to do with it (missed opportunity if you ask me), is that a crime now?
- DebtDeflation 4y ago
  I may be in the minority here but IMO the only really legitimate purpose a "Tim Horton's app" would have for accessing location data would be to push offers to you when you're near one of their stores, and that should be opt-in not a default. Also, there's no legitimate reason for them to actually be storing the data - it's an app that you use to purchase coffee from retail locations, it doesn't need to track me 24/7 and store the info in a database. The number of apps that ask me for permission to access my Location, Contacts, Phone, Microphone, Camera, etc. is appalling. I feel like we need to revisit the whole idea of telemetry in mobile apps, like start over from scratch.
  - MiddleEndian 4y ago
    >I feel like we need to revisit the whole idea of telemetry in mobile apps, like start over from scratch. Also the operating systems. You get a new Android phone, Google Maps randomly comes up and tells you "Hey you're at this location, want to do this check-in bullshit?" even though it wasn't previously open. And yet, the app list button only shows a few things that have viewable windows, no easy way to see every background task that's running adn presumably spying on you. It's designed like this deliberately.
brundolf 4y ago
Reminder that in addition to denying location permissions, on iOS you'll also want to turn off "Background activity" for apps that don't have a reason to need it. There was an article a couple years ago where some apps were polling your course location in the background based off of your IP address.
Cipater 4y ago
Hang on. >The Tim Hortons app asked for permission to access the mobile device’s geolocation functions, but misled many users to believe information would only be accessed when the app was in use. In reality, the app tracked users as long as the device was on, continually collecting their location data. Does this mean that the prompt is completely useless?
- Cd00d 4y ago
  Not sure why this is getting downvoted. I think it's a good and reasonable question. I suspect it's the difference between an app's prompt and the OS's prompt.
- 9935c101ab17a66 4y ago
  I suspect, at least on iOS, they would present users with a message in app during setup saying something like: “we aren’t scum bags, we promise, and we’re about to ask for access to your location data, but we’ll only use it to help you find stores and cool stuff like that!” And then they invoked the system permissions dialog that allows the user to grant location access, but instead of only asking for permission to access user data when the app is open, they told iOS to ask the user if they could always have access to location data. This is clearly a different prompt, but I’m almost certain most users either aren’t able to discern the difference, don’t know the consequences or think it’s normal. Tbh, there are very few situations I can think of where I’d want to let an app always have access to my location. I just checked my iOS location privacy settings, and other than system services, the only app that always has access to my location is weather (but I could probably turn that off). I wonder if apple’s app review team closely scrutinize any app that asks for always on location data? I couldn’t find any that had an option for ‘alway” on my phone other than Uber.
  - alickz 4y ago
    >And then they invoked the system permissions dialog that allows the user to grant location access, but instead of only asking for permission to access user data when the app is open, they told iOS to ask the user if they could always have access to location data. It's been a while since I used CoreLocation but I do not think this is possible. To request Always location permissions iOS apps _must_ first request When In Use location permission. Only then, after the user grants Allow While Open (not Allow Once), and iOS starts delivering location updates to the app, will the iOS system give a _second_ prompt to the user requesting Always permission. There's no way to jump straight to the Always permission AFAIK. https://developer.apple.com/documentation/corelocation/cllocationmanager/1620551-requestalwaysauthorization https://developer.apple.com/documentation/corelocation/clloc... > If your app’s current state is CLAuthorizationStatus.notDetermined (the default) and you call requestAlwaysAuthorization(), Core Location uses two prompts before it fully enables Always authorization. > The first prompt displays immediately with the string from NSLocationWhenInUseUsageDescription. > The second prompt displays when Core Location prepares to deliver an event to your app requiring CLAuthorizationStatus.authorizedAlways. If the app is in the Provisional Always state, the system displays the second prompt with the string from NSLocationAlwaysUsageDescription. Core Location will typically display the second prompt when your app isn’t running.
CosmicShadow 4y ago
Is there any sort of app (android) I can download that will tell me what other apps are constantly tracking my location and reporting back when they are not open? I'd also love that for anything that's constantly listening to what I say and reporting back.
jeffwask 4y ago
- Install our app get $5 off your next purchase - Web special; only can only be order via the app - Free fries when ordering via our app They only want your data. Fuck your business. Fuck the food. It's all about your data.
- astrange 4y ago
  They want you to use the app so you don't take up workers time by making them act as a cashier.
sys_64738 4y ago
This is why I don't install garbage apps on my iPhone.
emptybits 4y ago
> "This investigation sends a strong message to organizations..." Canadian here. Sorry, sending a sternly worded message to law breakers isn't enough. > " The good news in this case is that Tim Hortons has agreed to follow the recommendations we set out," No. GOOD news in such a case isn't an agreement to follow the law in the future. Didn't they already do that and then break the law?! Good news in such a case might be, oh let me think ... a temporary loss of business license for violation of laws and customer trust, and then fines (or revenue loss due to license suspension) of a magnitude that shareholders or the parent company feel which can then inform the board, executive responsibility, policy decisions right down the chain, etc. This is law-breaking for profit.
- deleted 4y ago
  [deleted]
jordanmorgan10 4y ago
You wanna believe that your data is safe with your donut chain of choice. Everyone wants to believe that.
unfocused 4y ago
The actual detailed report can be found here: https://www.priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-into-businesses/2022/pipeda-2022-001/ https://www.priv.gc.ca/en/opc-actions-and-decisions/investig... Essentially, both Android and iOS apps were collecting data. Also interesting to note, that Ontario accounted for 54% of purchases in May 2020, of people that used this app. I wonder how close it to actual sales. Full disclosure, I just used this app today in Ottawa. Doh!
- tossstone 4y ago
  Ontario contains almost half of Canada's population so that seems very plausible
  - mthoms 4y ago
    It's actually 38% according to Wiki. Still a lot.
- paxys 4y ago
  Ontario makes up ~40% of Canada's population, so that isn't too far off. It probably goes up to >50% when you filter on young urban professionals, who are the target demographic of Tim Hortons.
  - tempest_ 4y ago
    Aha that might be their target but young urban professionals are not likely to be the largest demographic. That demographic prefers Starbucks, and more likely some hip 3rd wave place over timmies.
    - brailsafe 4y ago
      Ya that surprised me. I'm sure as hell not going to Tims if I can help it.
  - mb7733 4y ago
    What kind of yuppie goes to Tim Hortons?
kornhole 4y ago
Based on my surveys of people in the US, 97-99% of people with handsets are location tracked nearly 24/7. I am in the 1% with my hardened phone free of Goople and on airplane mode 99% of the time. I hope these companies continue to be exposed and help people choose where to buy our coffee and not give up their freedom for coupons.
wly_cdgr 4y ago
Everyone needs to chill, they are just market testing their new Chocolate Frosted With Chocolate Sprinkles Tracking Donut
walrus01 4y ago
in my experience the ordinary android or ios end user will automatically click "yes/accept/allow permission" on almost anything that pops up on their screen.
darepublic 4y ago
I should stop going to Tim's. Not just because of this, in fact the thought was already in my mind this morning as I was in a huge car lineup for morning drive-thru that extended out of the Tim Horton's parking lot and into the side street, barring entry to other businesses. And the garbage bins were overflowing with discarded coffee cups and dripping with spilt coffee. A rare but not insignificant minority of drive-thru workers can be downright authoritarian, once you pick up your order from the window some of them will bark at you to gtfo, even if you just take a moment to settle your coffee cup into it's holder.
sirsinsalot 4y ago
Even though as a software developer in Europe, it makes my life much more complicated, I hope more GDPR-like measures are implemented and enforced. I know that might be at odds with many on HN's opinions, but government/regulatory protection for consumers has a place.
hnburnsy 4y ago
Thanks Google for not allowing us users the ability to stop apps from starting up or not allowing apps to run in the background. Dicks. Every granted app permission should have the ability for the user of the device to revoke that permission.
- ls15 4y ago
  And I should be able to provide fake data to apps out of the box. Some location that I can set manually, an address book with fake contacts, an image/video of my choice instead of camera access, audio for microphone, a directory of my choice for file/media access... All of these apps are not entitled to collect accurate data. I think there is an app on f-droid that does this.
- minsc_and_boo 4y ago
  Google reviews all background location requests for apps: https://support.google.com/googleplay/android-developer/answer/9799150?hl=en https://support.google.com/googleplay/android-developer/answ... The app from the article was collecting the data up until 2020, when Google launched this new app approval process.
  - hnburnsy 4y ago
    Don't they get around this with wifi scanning, viewing network connections and bluetooth scanning?
    - theptip 4y ago
      Don’t all of those things come under the “location services” permission?
      - minsc_and_boo 4y ago
        They do. You can't access wifi scanning w/o location permission from user.
thepasswordis 4y ago
It's so interesting seeing this. There is currently a film making the rounds in right wing/election-interested circles called 2000 Mules. In the film, the narrator/host purport to have purchased several trillions of points of tracing data from the time around the 2020 election, and claim to have identified "ballot mules", that is: people who appeared to be going from various Democrat affiliated non-profits to many different ballot boxes in their city. The conclusion being: these people were stuffing ballot boxes. However, the "technical" take downs of these claims are that this location data is not accurate enough to support them. But then articles like this come out, or many of the comments below, which do support the idea that you could purchase highly accurate GPS tracking data of "anonymized" cell phone users. It's just interesting how the technical analysis on these things seems to change so dramatically based on what the context is.
Vladimof 4y ago
What are those weird lines on the background of this web page? I thought my kids misused crayons for a bit...
0daystock 4y ago
A lot of people are rightfully upset over this, but a more nuanced point: if your phone is capable of installing "apps" from a "store" - there is far, far more insidious data collection going on by significantly more capable adversaries.
rdxm 4y ago
johndhi 4y ago
Don't really care about stupidly drafted privacy laws being violated. They do nothing for me.
theptip 4y ago
Say what you will about the pains of implementing GDPR, I think it mostly got the core concepts right. We should implement something similar in the USA. California’s CCPA is a step in the right direction, but it seems to lack any teeth. Apps should not be allowed to collect data on you without your consent. And, they should not be able to just claim they need everything; without a legitimate need you should be able to opt out of tracking like the OP. And finally, the fines should have teeth so that offenders are actually incentivized to avoid infringing, instead of getting a slap on the wrist and profiting from violations.
brailsafe 4y ago
Good thing they were fined into oblivion! Oh wait, they weren't? They were just asked to accept some suggestions you say?
awinter-py 4y ago
per linked 'report of findings' this is from the radar sdk? > Once a User granted the App permission to access their device’s native location functionality (based on GPS), the SDK began, based on TDL’s configuration of the App and subject to certain limitations outlined in further detail in paragraph 26, collecting the User’s granular location data (“Radar Location Data”), including precise longitude and latitude coordinates, and forwarding that information to Radar’s servers to be processed for Tim Hortons – thereby tracking the User’s device location have never used radar sdk, wonder if this is the default config or it has to be enabled
908B64B197 4y ago
Were-they collecting data on European citizens? Seems if so they could have to pay a hefty fine thanks to GDPR...
Jemm 4y ago
In true Canadian form there will likely be minor repercussions.
Layke1123 4y ago
Duh, isn't it obvious that a whole part of business is trying to find ways to make money off the government, not just your customers? Tech has been doing this for a while if you are anyone at the exec level or have tried to understand what "business reasons" are when told that's why a bad technical decision is being made.
dghughes 4y ago
Canadian Tire should be next. I don't trust their rewards app one bit. I refused to get it when it came out. Reading their terms to cancel your subscription to the virtual coupons for dollars spent (aka Canadian Tire money) you need call their phone support line. No web-based cancellation but you can sign up for it using their web-based service.
openplatypus 4y ago
> Tim Hortons agreed to implement the recommendations. Wow. No fines. No consequences. Is Canada's privacy law really so toothless?
dlkjelk 4y ago
You can easily purchase massive amounts of cell phone location data via marketplaces such as https://datarade.ai/ https://datarade.ai/ . You can get IMEI and many other identifiers. It's trivially to translate that to a person by geofencing their house. Plenty of recent articles about people going to abortion clinics and getting doxxed over it.
advertising 4y ago
Friend works for real estate group that provides consulting services for companies looking to move into a new area. Friend can drag a box around any area down to the block and see how many people visit that area, what part of the city they came from to get there, where they went to next, average income, etc etc etc We all know we are being tracked but seeing him use his software was still shocking. Apparently all data is from 3rd party apps and they charge $30k++ for their real estate analysis service. Who knows how much they pay for the actual data or how many times over it’s sold. It’s all anonymous but adding just a small bit of information about an individual and pretty easy to figure out and track them even off this anonymized 3rd party data. Scary hours
- christophilus 4y ago
  I don’t have many apps. I use my browser for just about everything: weather, search, YouTube, etc. I’d be really interested to see how much my phone leaks to services like this vs the average phone. I bet it’s still a shockingly large amount. That said, doesn’t iOS notify you when an app wants to use location services? Did all of these users just opt into that? That seems crazy, if so.
  - willstrafach 4y ago
    > That said, doesn’t iOS notify you when an app wants to use location services? Did all of these users just opt into that? That seems crazy, if so. Not so crazy. Local news, weather, and similar apps with a reasonable rationale for Location Services access are often the culprits. They will put phrases like “See privacy policy.” in the justification text (When asking permission) so they can claim that the user consented.
UberFly 4y ago
Like a tin-foil hat model I install as few apps as I possible can, and definitely no corporate ones. State Farm for instance keeps hounding everyone to use their app. Soon it'll be: use our app or you'll be charged an extra 10%. No thanks.
fnordpiglet 4y ago
This is why I only drink rain water and pure grain alcohol.
dukeofdoom 4y ago
I think people need to start thinking about owning two phones now. One for Personal use. And one for government / business related use that you would have turned off most of the time to avoid tracking. With the increasing push to have government apps installed (for example ArriveCan) and the new bill where they want to search your phone at the border. You don't know how soon making fun of Trudeau on social media, or questioning covid rules will become a crime.
8jef 4y ago
Buying shit filter coffee while being spooked on, and never care about anything, sounds like living the Dream. Dream on.
beninsydney 4y ago
I'm looking forward to quitting the App Store once sideloading is allowed, once I can get my iPhone software from GitHub I won't go back to apps vacuuming up my data under Apple's oversight.
adammenges 4y ago
I’m not interested in starting a flame war, but am interested to know how many of the users who were being tracked everywhere they go without the app being opened were iOS users and how many were android. Unfortunately the post doesn’t go into much detail.
- ccouzens 4y ago
  If you search for Android or iOS within this page, practically everything that happens for one happens for the other https://www.priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-into-businesses/2022/pipeda-2022-001/ https://www.priv.gc.ca/en/opc-actions-and-decisions/investig... The report is about the app before September 2020. I believe location permission controls have improved on both operating systems since then.
tlavoie 4y ago
Linked from elsewhere, the original Financial Post story that triggered this specific investigation is quite the eye-opener. The reporter filed a PIPEDA request to get a copy of their own data, and then goes on to describe the findings in quite some detail. https://financialpost.com/technology/tim-hortons-app-tracking-customers-intimate-data https://financialpost.com/technology/tim-hortons-app-trackin...
april_22 4y ago
The exploitation and misuse of data by most apps we use is really sad but a reality we habe to accept. I am happy that here in the EU more and more regulations and antitrust lawsuits are being put in place.
runeks 4y ago
> The Tim Hortons app asked for permission to access the mobile device’s geolocation functions, but misled many users to believe information would only be accessed when the app was in use. In reality, the app tracked users as long as the device was on, continually collecting their location data. Why is this even technically possible? The iPhone app permissions settings has three modes: “always”, “when in use”, and “off”. I assume the second setting only allows the app to collect data when the app is actually in use? Does Android not distinguish between “always” and “when in use”?
- 9935c101ab17a66 4y ago
  As far as I can tell, this happened between 2017-2020, so things have changed a little bit. You’re correct in that the second setting only allows an app to query native location data from the OS when the app is open but: 1) I’m assuming that’s not the scope Tim hortons asked for with their permission dialog (they lied about it, sure, by saying they would only use your location when you were using the app, but they presented the user with a prompt that granted them unfettered access). I’m guessing most users didn’t even notice, or aren’t aware of the consequences. 2) they relied on some sketchy third party company called “radar,” and I’m sure they also use heuristics beyond location data to figure out where the users are. I’d love to know if the changes apple made with iOS 14.5 would have made this more difficult? Anyway, this is disgusting and I wish there were serious, unavoidable repercussions. (Disclosure: I only skimmed the actual report, I didn’t read the whole thing)
doctor_eval 4y ago
> The investigation concluded that Tim Hortons’ continual and vast collection of location information was not proportional to the benefits Tim Hortons may have hoped to gain from better targeted promotion of its coffee and other products. Is that the standard for privacy these days in Canada? It would have been OK if the benefits to the business were proportional?

700 points by danso 4y ago

5M+ downloads according to Play Store. More on Apple.

> The app also used location data to infer where users lived, where they worked, and whether they were travelling. It generated an “event” every time users entered or left a Tim Hortons competitor, a major sports venue, or their home or workplace. yikes

deleted 4y ago
[deleted]

skipants 4y ago

>Consistent with this explanation, our Offices confirmed that the SDK tracked, as Events, home, office, geofenced locations (including its competitors), and travel in and out of Canada. For example, news articles had noted that an event was recorded with computer code such as “user.entered.place” with “place.name”: “Rogers Centre”, or “user.entered.office”.Footnote 16 Using open-source resources and tools, the investigative team’s technology analysts determined that the SDK programming code included the following: USER_ENTERED_HOME; USER_EXITED_HOME; USER_ENTERED_OFFICE; USER_EXITED_OFFICE; USER_STARTED_TRAVELING; USER_STOPPED_TRAVELING; and USER_ENTERED_GEOFENCE; USER_EXITED_GEOFENCE. This is just downright appalling.

Gak2 4y ago
quick google search... looks like the LiveShopper SDK
deleted 4y ago
[deleted]

davidkuennen 4y ago

Crazy. I suppose they stopped after Google and Apple tightened their rules in 2020 regarding location tracking and not because of a change of heart.

LegitShady 4y ago
they don't say exactly when and why they disabled the tracking except "in 2020", but in june 2020 when the original expose on their trackign appeared in the Financial Post, tims had no plans to disable the tracking, just to edit their privacy and other policy texts so that it wasn't outright them lying. https://financialpost.com/technology/tim-hortons-app-tracking-customers-intimate-data https://financialpost.com/technology/tim-hortons-app-trackin... There is the above privacy investigation but also a bunch of class action lawsuits filed in multiple provinces.

curt15 4y ago

This is why I always use a retail store's mobile website and never download their "app". The browser sandbox saves me from having to worry about these shenangians.

travisporter 4y ago
How do the apple app clips work in this regard? Can they collect location info?
- hooksfordays 4y ago
  According to Apple’s support site[0] App Clips can request your location, and permission’s automatically revoked after 1 day, and only works while the apple clip is in use. So, better in theory. [0] https://support.apple.com/en-us/HT212238 https://support.apple.com/en-us/HT212238
- mikestew 4y ago
  Because there is a setting for it, I assume that app clips can request location info. I have to assume, as there apparently is no app clip that has ever requested such. Come to think of it, I don't know that I've used an app clip. But the setting is there.
switchbak 4y ago
I assume that at least one of the apps I have is probably sharing all my data right now. Be it the flashlight or the guitar tuner, or that menu planner thing. I remember a time when app developers weren't the user's enemy, but that was a long time ago.
Fauntleroy 4y ago
...until they decide they'll make more money by forcing mobile users to use the app and start kneecapping the mobile web experience left and right. We need strict regulation for this or it'll never end.
mikepurvis 4y ago
A&W is so disorganized that they have a mobile app for placing orders at nearby restaurants, but to get coupons, you go to a separate awcoupon.ca website. The coupons are quite worthwhile, often 30-40% off the sticker price for common meal deals, but it's baffling that it wouldn't be integrated into the main app.

version_five 4y ago

I assume every app that has location permission does this. I can't imagine google doesn't, or the phone company. I don't think it's right (and even less right that apparently google will provide this information to law enforcement). I just think the only practical thing to do is assume you are being tracked and don't install apps unless you're ok with the tradeoff. The flip side of this, is why would I ever install a Tim Hortons app, why do I think they are offering an app, and what possible meaningful benefit (even assuming I went there regularly) would I drive from having an app?

davidkuennen 4y ago
Most store apps I know offer some kind of discount or membership program with points if they use the app. I guess something like that.
- monkeybutton 4y ago
  Afaik they made Roll Up The Rim digital and in-app only because of covid.
  - ChoGGi 4y ago
    I used their website for rolling up, worked mostly alright.
Li7h 4y ago
Smart assumption to make. On the flip side, people install the app because they usually are how the rewards programs are implemented now. From the app page: Mobile Order & Pay Select and customize your favourite food and drinks, choose your preferred Tim Hortons location, and pay from the app. It’s now that easy to order your favourite Tim Hortons items from your phone. Personalized Menu Add recently ordered items with one tap. Customized orders are saved on your menu so you can get your order just the way you like it. Tims® Rewards After just seven eligible purchases, receive your choice of a FREE coffee, tea or baked good. Keep checking for more special offers to come. It’s time to reward your routine! Scan for Tims® Rewards A digital version of your loyalty card that you can scan easily when ordering in the restaurant – never miss an opportunity to earn rewards. Scan to Pay Save time and pay for your order right from the app -- no need to carry cash or a credit card! Take Out, Dine In or Drive Thru Choose your pick-up method. Payment is completed in-app, so you can grab your order to go, or dine in with us. Your choice.

revolvingocelot 4y ago

>“This investigation sends a strong message to organizations that you can’t spy on your customers just because it fits in your marketing strategy. Not only is this kind of collection of information a violation of the law, it is a complete breach of customers’ trust. The good news in this case is that Tim Hortons has agreed to follow the recommendations we set out, and I hope other organizations can learn from the results of this investigation.” – Michael McEvoy, Information and Privacy Commissioner for British Columbia Insane that there isn't any more forceful enforcement for "a violation of the law" than setting out "recommendations" and trusting that the guys under investigation for "violation" of the, presumably, privacy "law" will implement it.

airstrike 4y ago
You'd need a lawsuit for that. The investigation FTA was by "privacy agencies" which have no ability to enforce anything more severe than recommendations
- deleted 4y ago
  [deleted]
- revolvingocelot 4y ago
  I actually did read the article; I even grabbed a quote from it! Still, the governmental privacy authorities suggest that the law was broken; I'm aware that they aren't enforcement, because I read the article, but the language is pretty clear that they think these actions broke the law. >You'd need a lawsuit for that Can you elaborate? Is there Canadian privacy law being violated here that doesn't stipulate any penalty other than exposing Tim Hortons to private lawsuits? Forgive the directness of my question, your comment reads like you'd know. edit: reading the Report of Findings [0] on the page itself suggests that because the violations ceased once, er, the violating entity had been informed of the investigation and had suggested that it'd delete the harvested data, the joint investigation "therefore found this matter to be well-founded and conditionally resolved". So, nobody really cares [0] https://www.priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-into-businesses/2022/pipeda-2022-001/ https://www.priv.gc.ca/en/opc-actions-and-decisions/investig...

sitkack 4y ago

The fact that was labeled just means that they were inferring it on the client. Given any location stream from a person and POI data you can infer all of this stuff, including if they have kids, a mistress, if they are gay or straight, if they are religious, friends, age, sex, nationality. I think Tim Hortons should be required to analyze and publish the data from questions supplied by the public. What is the likelihood that I will have to visit a bathroom within X minutes after consuming a Tim Hortons? Visit a hospital? Get in a car crash? What percentage of Tim Hortons customers also visit strip clubs? What is the average waiting time in line for a TH visitor? Thoughts?

rfwhyte 4y ago

Wildly disappointing that this massive, and blatantly illegal collection of user location data has (of course) merely resulted in a slap on the wrist for the perpetrators here. There should be huge (multi millions) fines and probably even jail time for the execs who approved / managed this app, but as per usual our corporate overlords get off with a "Stern warning" and a promise not to do it again.

gralx 4y ago
On the face of it, no politician wants to risk tanking an org that employs a significant part of their jurisdiction. Providing even minimum wage employment to thousands is an objective public good and hard to do, even for scoundrels. Big employers are not above the law, but they sure get more leeway.
- cardy31 4y ago
  Honestly with Tim Hortons I bet the number of voters working there are quite small. They are one of the biggest users of the Temporary Foreign Worker program in Canada. Many locations are full of foreign workers. Some of these are students, some are from the program, but either way they largely aren’t voters.

blorenz 4y ago

I recently attended an automotive dealership conference where I was being pitched for a product that would let me know if my customers were at rival dealerships. I poked and prodded to understand if these were legitimate claims or just marketing hype. They revealed that they purchased location data from app developers. I was shocked and surprised -- I don't know why I was because this should have been expected. It really enlightened me on the exploitation and misuse of data by crappy apps.

sitkack 4y ago
Not just app data, but you can also purchase celltower data, https://airsage.com/ https://airsage.com/ It is easy to fuse with other sources.
roywiggins 4y ago
This investigation from a couple years ago in the NYT was pretty good: https://www.nytimes.com/interactive/2019/12/19/opinion/location-tracking-cell-phone.html https://www.nytimes.com/interactive/2019/12/19/opinion/locat...
- jonhohle 4y ago
  It’s funny that when the story is about their political allies, that data becomes much less concerning: > “It’s really, really hard to assign even what side of the street you’re on when you’re using this kind of data,” said Paul Schmitt, a research scientist and professor at the University of Southern California. https://www.nytimes.com/2022/05/29/us/politics/2000-mules-trump-conspiracy-theory.html https://www.nytimes.com/2022/05/29/us/politics/2000-mules-tr...
  - neuronexmachina 4y ago
    Looking at the preceding paragraphs, I'm not sure I understand what point you're trying to make: > Mr. Phillips and Ms. Engelbrecht’s case is largely built on cellphone data. A report created by the group includes an appendix that claims to list “IMEI” numbers of the tracked devices — 15-digit codes unique to each cellphone. But each entry on the list is a 20-character string of numbers and letters followed by a lot of x’s. Mr. Phillips said new IDs had been created “to obfuscate the numbers.” >"The same report says the group “purchased 25 terabytes of cellphone signal data emitted by devices” in the Milwaukee area in a two-week period before the 2020 election. They claim to have isolated 107 unique devices that made “20 or more visits to drop boxes” and “multiple visits to nongovernmental organizations” that were involved in get out the vote efforts. >A number of researchers have said that while cellphone data is fairly precise, it cannot determine if someone is depositing ballots in a drop box or just passing by the area. >“It’s really, really hard to assign even what side of the street you’re on when you’re using this kind of data,” said Paul Schmitt, a research scientist and professor at the University of Southern California.

gjsman-1000 4y ago

Uh huh - if I am Tim Hortons, the slap of the wrist was just the price of this valuable information and the insights retrieved from it.

thfuran 4y ago
And it was a steal.

UI_at_80x24 4y ago

For those of you who don't know who/what "Tim Horton's" is allow me to educate and enlighten. https://en.wikipedia.org/wiki/Tim_Hortons https://en.wikipedia.org/wiki/Tim_Hortons It's a 'fast food/coffee' chain that really was made popular by a recurring skit on a TV show called: Royal Canadian Air Farce (Sketch based usually heavy on the political satire) The skit had 3 people sitting around a table drinking coffee and cracking jokes about current-events and mostly political fiascos. It was this lampooning of 'typical Canadian behaviour' of art imitating life that caused more people to show up and start hanging out at the corner coffee shop. In my small home town (40,000 people) there were maybe 3 shops (aka Timmies). During this boom to it's popularity that number increased by atleast 10. They made their doughnuts in-house every morning, and the coffee was tolerated as being acceptable. As the franchise grew in popularity it became something of a joke and expectation that a person could find a Timmies on nearly every block, and you would never need to drive more then 10 minutes to get to the closest one. Throughout it's financial hardships and ownership changes there has been a lot of complaints that "The coffee isn't as good as it used to be." And rumours that McDonalds (with it's McCafee push) bought Timmies old supplier of beans. Now the food is no longer made in store, and my impression is that the coffee is worse. There have been other cost-cutting measures like making the popular contest "Roll up the Rim" (where a person could unroll the lip of the cup of coffee to reveal a prize from free confections, to money and a car); becoming an APP-only prize (more like a lottery style jackpot then a winning cup). In total, I am not surprised. Their quality has gone downhill, and the treatment of staff is horrendous.

loceng 4y ago
"becoming an APP-only prize (more like a lottery style jackpot then a winning cup)." Sooo they could track exactly where their customers were going?
stewx 4y ago
Also, the chain is named after its former NHL player founder, who died after crashing his car while drunk and on drugs.
- UI_at_80x24 4y ago

cs702 4y ago

The industrial data-gathering complex is expanding into ever more ethically dubious, ever more ridiculously unjustifiable niches. For an instant, I thought the OP might be a link to a fake story in The Onion. I mean, it wouldn't be out of place there: "Fast-food chains collecting vast amounts of location data." And yet, no one is shocked.

micah63 4y ago

When Burger King "bought" Tim Hortons in 2014 (I believe this was a tax evasion effort by Burger King to leave US and "merge" with a Canadian food company), the whole experience went to pot. This was a Canadian institution. I won't even step foot in a Tims anymore, the food, the customer experience, the app, it's all junk.

midasuni 4y ago
Interesting. My first trip outside of Europe was my honeymoon in 2008 to Canada. Various tour guides told us that Tim Hortons (“Timmy’s”) was a Canadian institution. Since then I’ve travelled a fair bit in US cities and a little in Canada and the only real difference I can see is that Canada has a Tim Hortons on the corner.
- Marsymars 4y ago
  I mean, I'd still call it a Canadian institution, but it's not good. > Since then I’ve travelled a fair bit in US cities and a little in Canada and the only real difference I can see is that Canada has a Tim Hortons on the corner. Depends where you go. There's probably more of a different cultural feel in Quebec and the Atlantic provinces. e.g. Café Olimpico is a Montreal institution that feels quintessentially Montreal. (And the US has places with very different cultural feels to each other - of places I've visited, Honolulu isn't very similar to Billings - but I'm less familiar with the US than Canada.)
  - midasuni 4y ago
    I was amazed by many things with our 3 weeks in Canada, including how cheap car hire for a massive (Ford escape) car was, how wide the roads were, how off road logging roads were But one thing that stuck with me was seeing things I’d only ever heard of in tv/movies - Wendy’s and Dairy Queen come to mind. But I’d heard of them. And of course Starbucks (which we had in the U.K.) Never heard of Tim Hortons though, which I guess shows the relative strength of a medic an cultural exports vs Canadian cultural exports.
  - 908B64B197 4y ago

lykahb 4y ago

Is there any other purpose of making an app other than surveillance and ads?

indymike 4y ago
In this case, taking an order from a consumer and collecting a payment comes to mind. Just because you have a useful app doesn't mean you have to sell the user's location data to make money, ESPECIALLY if you are ALREADY making money with the app.
- gruez 4y ago
  > In this case, taking an order from a consumer and collecting a payment comes to mind. all of this can be done in a web app, including the payment (apple pay).

jordemort 4y ago

"Timbits? More like Timbots!"

midislack 4y ago

autoexec 4y ago
> So just stop installing stupid apps and you don't have to worry about issues like this. I agreed with you up until that last line. The problem is that this sort of invasive tracking isn't limited to the apps on your devices. The devices themselves are spying on you, and the lack of meaningful privacy protections leaves us vulnerable even if we left our cell phones sitting in lead lined boxes. Without installing any apps on our phones at all this kind of pervasive tracking data could be collected using bluetooth beacons, using cell phone tower data, using facial recognition technology, using license plate readers, using the GPS/OnStar systems in our cars or using radar systems that see through the walls of our homes. This isn't a problem our personal choices can solve. We only have the power to make choices that hurt us in different ways. We need real regulation and laws with many rows of very sharp teeth.
- 2OEH8eoCRo0 4y ago
  What? You can't live like God Emperor Stallman smugly using your flip phone and eating toe jam?
- midislack 4y ago
  The government likes all this tracking and spying. If you think you can rely on the government to cure this ill you're mistaken. It's still possible to live without a cell phone at all.
  - autoexec 4y ago
    > The government likes all this tracking and spying. I agree, and some companies like collecting it and enjoy being paid to hand it over to the state. I don't think that makes it impossible to outlaw this stuff, but it does make it much harder. We'll likely need a number of reforms around elections and bribery to get people in office who will represent our interests but however difficult they've made it so far (and they've been refining their techniques for centuries), it is still possible to elect a person of our choosing. > It's still possible to live without a cell phone at all. Not without considerable difficulty though. I put it off for about a decade or so after flip phones were replaced by smart phones until eventually my family insisted on my having one out of concern. They even bought the damned thing for me. I'm still conflicted about owning it. Even at that time it was growing more troublesome to function without one though since many businesses were offering services exclusively over their apps. Like I said though, not having a phone won't spare you. There is an ever-growing list of ways to collect and track your activity both online and offline which don't depend on cell phones or apps. Ultimately, we're either going to have to insist on the kind of regulations we need to be protected or we'll have to resign ourselves to abuses enabled by the data collection going on.

user3939382 4y ago

Slap on the wrist for willfully violating the privacy of a massive amount of people. Par for the course in the US as well. Yet try violating the Wiretap Act as an individual, even accidentally, and see how it works out for you. That difference in results between giant corporations and individuals should give you a strong clue about who the “justice” system works for.

system16 4y ago
I wouldn't say it's a slap on the wrist. It's not even a scolding. Tim Hortons was literally found guilty of spying on millions of Canadians, and the only consequence they face is that they have to stop doing it.
autoexec 4y ago
> That difference in results between giant corporations and individuals should give you a strong clue about who the “justice” system works for. It's not just the justice system either. It's also representation in government. We have research showing that the average citizen has effectively zero influence on public policy and that our government caters exclusively to corporations and a small number of extremely wealthy individuals. The only time the rest of us get something we something we want is when our interests just happen to align with the interests of the powerful. (see https://scholar.princeton.edu/sites/default/files/mgilens/files/gilens_and_page_2014_-testing_theories_of_american_politics.doc.pdf https://scholar.princeton.edu/sites/default/files/mgilens/fi...)

sharmin123 4y ago

DwnVoteHoneyPot 4y ago

> The Tim Hortons app asked for permission to access the mobile device’s geolocation functions, but misled many users to believe information would only be accessed when the app was in use. In reality, the app tracked users as long as the device was on, continually collecting their location data. How does this work on an iPhone? If in Location Services and I have app set as "While Using the App", I'm assuming it's not possible for Tim Horton's app to collect data "as long as devices was on". Did it somehow bypass these settings?

LeoPanthera 4y ago
That setting cannot be bypassed on iOS.
- barbazoo 4y ago
  Can it be bypassed on Android? Until now I assumed "While using the app" means exactly that.
  - minsc_and_boo 4y ago
    No, it can't. Google reviews every Android app that is requesting special permission for background location access. Tim Hortons was doing this back prior to 2020 when Google started requiring approval.
- brewdad 4y ago
  Does allowing Background Refresh trick iOS into thinking the app is in use?
  - ThePowerOfFuet 4y ago
    No. "In use" means displayed as the frontmost app on iOS.
gnabgib 4y ago
As others have noted the app works fine without location on. (Android also has "only when using App" settings) It does default full location access all the time which is where the problem starts. Sane defaults required.

evandale 4y ago

I'm reminded of the corporation taken to arbitration story yesterday. I'm curious if you would be able to get anything from Tim Hortons if you did that.

octobus2021 4y ago

I'm against companies tracking my whereabouts and wanting to know everything about my personal life. However. Here's what the "charges" are as per the statement: >The investigation concluded that Tim Hortons’ continual and vast collection of location information was not proportional to the benefits Tim Hortons may have hoped to gain from better targeted promotion of its coffee and other products. So it's obviously ok for a business to collect information. This includes information _legally_ collected from customers' phones (I'm sure everybody just clicks OK agreeing to the terms when installing the app). So what's the issue? That the amount is "vast"? That it's "continuous"? That it's "not proportional to the benefits"? Who decides what's vast and what's not, what's proportional and what's not? I'm really not getting what they're being accused of doing. They got a lot of data and had no clue what to do with it (missed opportunity if you ask me), is that a crime now?

DebtDeflation 4y ago
I may be in the minority here but IMO the only really legitimate purpose a "Tim Horton's app" would have for accessing location data would be to push offers to you when you're near one of their stores, and that should be opt-in not a default. Also, there's no legitimate reason for them to actually be storing the data - it's an app that you use to purchase coffee from retail locations, it doesn't need to track me 24/7 and store the info in a database. The number of apps that ask me for permission to access my Location, Contacts, Phone, Microphone, Camera, etc. is appalling. I feel like we need to revisit the whole idea of telemetry in mobile apps, like start over from scratch.
- MiddleEndian 4y ago
  >I feel like we need to revisit the whole idea of telemetry in mobile apps, like start over from scratch. Also the operating systems. You get a new Android phone, Google Maps randomly comes up and tells you "Hey you're at this location, want to do this check-in bullshit?" even though it wasn't previously open. And yet, the app list button only shows a few things that have viewable windows, no easy way to see every background task that's running adn presumably spying on you. It's designed like this deliberately.

brundolf 4y ago

Reminder that in addition to denying location permissions, on iOS you'll also want to turn off "Background activity" for apps that don't have a reason to need it. There was an article a couple years ago where some apps were polling your course location in the background based off of your IP address.

Cipater 4y ago

Hang on. >The Tim Hortons app asked for permission to access the mobile device’s geolocation functions, but misled many users to believe information would only be accessed when the app was in use. In reality, the app tracked users as long as the device was on, continually collecting their location data. Does this mean that the prompt is completely useless?

Cd00d 4y ago
Not sure why this is getting downvoted. I think it's a good and reasonable question. I suspect it's the difference between an app's prompt and the OS's prompt.
9935c101ab17a66 4y ago
I suspect, at least on iOS, they would present users with a message in app during setup saying something like: “we aren’t scum bags, we promise, and we’re about to ask for access to your location data, but we’ll only use it to help you find stores and cool stuff like that!” And then they invoked the system permissions dialog that allows the user to grant location access, but instead of only asking for permission to access user data when the app is open, they told iOS to ask the user if they could always have access to location data. This is clearly a different prompt, but I’m almost certain most users either aren’t able to discern the difference, don’t know the consequences or think it’s normal. Tbh, there are very few situations I can think of where I’d want to let an app always have access to my location. I just checked my iOS location privacy settings, and other than system services, the only app that always has access to my location is weather (but I could probably turn that off). I wonder if apple’s app review team closely scrutinize any app that asks for always on location data? I couldn’t find any that had an option for ‘alway” on my phone other than Uber.
- alickz 4y ago
  >And then they invoked the system permissions dialog that allows the user to grant location access, but instead of only asking for permission to access user data when the app is open, they told iOS to ask the user if they could always have access to location data. It's been a while since I used CoreLocation but I do not think this is possible. To request Always location permissions iOS apps _must_ first request When In Use location permission. Only then, after the user grants Allow While Open (not Allow Once), and iOS starts delivering location updates to the app, will the iOS system give a _second_ prompt to the user requesting Always permission. There's no way to jump straight to the Always permission AFAIK. https://developer.apple.com/documentation/corelocation/cllocationmanager/1620551-requestalwaysauthorization https://developer.apple.com/documentation/corelocation/clloc... > If your app’s current state is CLAuthorizationStatus.notDetermined (the default) and you call requestAlwaysAuthorization(), Core Location uses two prompts before it fully enables Always authorization. > The first prompt displays immediately with the string from NSLocationWhenInUseUsageDescription. > The second prompt displays when Core Location prepares to deliver an event to your app requiring CLAuthorizationStatus.authorizedAlways. If the app is in the Provisional Always state, the system displays the second prompt with the string from NSLocationAlwaysUsageDescription. Core Location will typically display the second prompt when your app isn’t running.

CosmicShadow 4y ago

Is there any sort of app (android) I can download that will tell me what other apps are constantly tracking my location and reporting back when they are not open? I'd also love that for anything that's constantly listening to what I say and reporting back.

jeffwask 4y ago

- Install our app get $5 off your next purchase - Web special; only can only be order via the app - Free fries when ordering via our app They only want your data. Fuck your business. Fuck the food. It's all about your data.

astrange 4y ago
They want you to use the app so you don't take up workers time by making them act as a cashier.

sys_64738 4y ago

This is why I don't install garbage apps on my iPhone.

emptybits 4y ago

> "This investigation sends a strong message to organizations..." Canadian here. Sorry, sending a sternly worded message to law breakers isn't enough. > " The good news in this case is that Tim Hortons has agreed to follow the recommendations we set out," No. GOOD news in such a case isn't an agreement to follow the law in the future. Didn't they already do that and then break the law?! Good news in such a case might be, oh let me think ... a temporary loss of business license for violation of laws and customer trust, and then fines (or revenue loss due to license suspension) of a magnitude that shareholders or the parent company feel which can then inform the board, executive responsibility, policy decisions right down the chain, etc. This is law-breaking for profit.

deleted 4y ago
[deleted]

jordanmorgan10 4y ago

You wanna believe that your data is safe with your donut chain of choice. Everyone wants to believe that.

unfocused 4y ago

The actual detailed report can be found here: https://www.priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-into-businesses/2022/pipeda-2022-001/ https://www.priv.gc.ca/en/opc-actions-and-decisions/investig... Essentially, both Android and iOS apps were collecting data. Also interesting to note, that Ontario accounted for 54% of purchases in May 2020, of people that used this app. I wonder how close it to actual sales. Full disclosure, I just used this app today in Ottawa. Doh!

tossstone 4y ago
Ontario contains almost half of Canada's population so that seems very plausible
- mthoms 4y ago
  It's actually 38% according to Wiki. Still a lot.
paxys 4y ago
Ontario makes up ~40% of Canada's population, so that isn't too far off. It probably goes up to >50% when you filter on young urban professionals, who are the target demographic of Tim Hortons.
- tempest_ 4y ago
  Aha that might be their target but young urban professionals are not likely to be the largest demographic. That demographic prefers Starbucks, and more likely some hip 3rd wave place over timmies.
  - brailsafe 4y ago
    Ya that surprised me. I'm sure as hell not going to Tims if I can help it.
- mb7733 4y ago
  What kind of yuppie goes to Tim Hortons?

kornhole 4y ago

Based on my surveys of people in the US, 97-99% of people with handsets are location tracked nearly 24/7. I am in the 1% with my hardened phone free of Goople and on airplane mode 99% of the time. I hope these companies continue to be exposed and help people choose where to buy our coffee and not give up their freedom for coupons.

wly_cdgr 4y ago

Everyone needs to chill, they are just market testing their new Chocolate Frosted With Chocolate Sprinkles Tracking Donut

walrus01 4y ago

in my experience the ordinary android or ios end user will automatically click "yes/accept/allow permission" on almost anything that pops up on their screen.

darepublic 4y ago

I should stop going to Tim's. Not just because of this, in fact the thought was already in my mind this morning as I was in a huge car lineup for morning drive-thru that extended out of the Tim Horton's parking lot and into the side street, barring entry to other businesses. And the garbage bins were overflowing with discarded coffee cups and dripping with spilt coffee. A rare but not insignificant minority of drive-thru workers can be downright authoritarian, once you pick up your order from the window some of them will bark at you to gtfo, even if you just take a moment to settle your coffee cup into it's holder.

sirsinsalot 4y ago

Even though as a software developer in Europe, it makes my life much more complicated, I hope more GDPR-like measures are implemented and enforced. I know that might be at odds with many on HN's opinions, but government/regulatory protection for consumers has a place.

hnburnsy 4y ago

Thanks Google for not allowing us users the ability to stop apps from starting up or not allowing apps to run in the background. Dicks. Every granted app permission should have the ability for the user of the device to revoke that permission.

ls15 4y ago
And I should be able to provide fake data to apps out of the box. Some location that I can set manually, an address book with fake contacts, an image/video of my choice instead of camera access, audio for microphone, a directory of my choice for file/media access... All of these apps are not entitled to collect accurate data. I think there is an app on f-droid that does this.
minsc_and_boo 4y ago
Google reviews all background location requests for apps: https://support.google.com/googleplay/android-developer/answer/9799150?hl=en https://support.google.com/googleplay/android-developer/answ... The app from the article was collecting the data up until 2020, when Google launched this new app approval process.
- hnburnsy 4y ago
  Don't they get around this with wifi scanning, viewing network connections and bluetooth scanning?
  - theptip 4y ago
    Don’t all of those things come under the “location services” permission?
    - minsc_and_boo 4y ago
      They do. You can't access wifi scanning w/o location permission from user.

thepasswordis 4y ago

It's so interesting seeing this. There is currently a film making the rounds in right wing/election-interested circles called 2000 Mules. In the film, the narrator/host purport to have purchased several trillions of points of tracing data from the time around the 2020 election, and claim to have identified "ballot mules", that is: people who appeared to be going from various Democrat affiliated non-profits to many different ballot boxes in their city. The conclusion being: these people were stuffing ballot boxes. However, the "technical" take downs of these claims are that this location data is not accurate enough to support them. But then articles like this come out, or many of the comments below, which do support the idea that you could purchase highly accurate GPS tracking data of "anonymized" cell phone users. It's just interesting how the technical analysis on these things seems to change so dramatically based on what the context is.

Vladimof 4y ago

What are those weird lines on the background of this web page? I thought my kids misused crayons for a bit...

0daystock 4y ago

A lot of people are rightfully upset over this, but a more nuanced point: if your phone is capable of installing "apps" from a "store" - there is far, far more insidious data collection going on by significantly more capable adversaries.

rdxm 4y ago

johndhi 4y ago

Don't really care about stupidly drafted privacy laws being violated. They do nothing for me.

theptip 4y ago

Say what you will about the pains of implementing GDPR, I think it mostly got the core concepts right. We should implement something similar in the USA. California’s CCPA is a step in the right direction, but it seems to lack any teeth. Apps should not be allowed to collect data on you without your consent. And, they should not be able to just claim they need everything; without a legitimate need you should be able to opt out of tracking like the OP. And finally, the fines should have teeth so that offenders are actually incentivized to avoid infringing, instead of getting a slap on the wrist and profiting from violations.

brailsafe 4y ago

Good thing they were fined into oblivion! Oh wait, they weren't? They were just asked to accept some suggestions you say?

awinter-py 4y ago

per linked 'report of findings' this is from the radar sdk? > Once a User granted the App permission to access their device’s native location functionality (based on GPS), the SDK began, based on TDL’s configuration of the App and subject to certain limitations outlined in further detail in paragraph 26, collecting the User’s granular location data (“Radar Location Data”), including precise longitude and latitude coordinates, and forwarding that information to Radar’s servers to be processed for Tim Hortons – thereby tracking the User’s device location have never used radar sdk, wonder if this is the default config or it has to be enabled

908B64B197 4y ago

Were-they collecting data on European citizens? Seems if so they could have to pay a hefty fine thanks to GDPR...

Jemm 4y ago

In true Canadian form there will likely be minor repercussions.

Layke1123 4y ago

Duh, isn't it obvious that a whole part of business is trying to find ways to make money off the government, not just your customers? Tech has been doing this for a while if you are anyone at the exec level or have tried to understand what "business reasons" are when told that's why a bad technical decision is being made.

dghughes 4y ago

Canadian Tire should be next. I don't trust their rewards app one bit. I refused to get it when it came out. Reading their terms to cancel your subscription to the virtual coupons for dollars spent (aka Canadian Tire money) you need call their phone support line. No web-based cancellation but you can sign up for it using their web-based service.

openplatypus 4y ago

> Tim Hortons agreed to implement the recommendations. Wow. No fines. No consequences. Is Canada's privacy law really so toothless?

dlkjelk 4y ago

You can easily purchase massive amounts of cell phone location data via marketplaces such as https://datarade.ai/ https://datarade.ai/ . You can get IMEI and many other identifiers. It's trivially to translate that to a person by geofencing their house. Plenty of recent articles about people going to abortion clinics and getting doxxed over it.

advertising 4y ago

Friend works for real estate group that provides consulting services for companies looking to move into a new area. Friend can drag a box around any area down to the block and see how many people visit that area, what part of the city they came from to get there, where they went to next, average income, etc etc etc We all know we are being tracked but seeing him use his software was still shocking. Apparently all data is from 3rd party apps and they charge $30k++ for their real estate analysis service. Who knows how much they pay for the actual data or how many times over it’s sold. It’s all anonymous but adding just a small bit of information about an individual and pretty easy to figure out and track them even off this anonymized 3rd party data. Scary hours

christophilus 4y ago
I don’t have many apps. I use my browser for just about everything: weather, search, YouTube, etc. I’d be really interested to see how much my phone leaks to services like this vs the average phone. I bet it’s still a shockingly large amount. That said, doesn’t iOS notify you when an app wants to use location services? Did all of these users just opt into that? That seems crazy, if so.
- willstrafach 4y ago
  > That said, doesn’t iOS notify you when an app wants to use location services? Did all of these users just opt into that? That seems crazy, if so. Not so crazy. Local news, weather, and similar apps with a reasonable rationale for Location Services access are often the culprits. They will put phrases like “See privacy policy.” in the justification text (When asking permission) so they can claim that the user consented.

UberFly 4y ago

Like a tin-foil hat model I install as few apps as I possible can, and definitely no corporate ones. State Farm for instance keeps hounding everyone to use their app. Soon it'll be: use our app or you'll be charged an extra 10%. No thanks.

fnordpiglet 4y ago

This is why I only drink rain water and pure grain alcohol.

dukeofdoom 4y ago

I think people need to start thinking about owning two phones now. One for Personal use. And one for government / business related use that you would have turned off most of the time to avoid tracking. With the increasing push to have government apps installed (for example ArriveCan) and the new bill where they want to search your phone at the border. You don't know how soon making fun of Trudeau on social media, or questioning covid rules will become a crime.

8jef 4y ago

Buying shit filter coffee while being spooked on, and never care about anything, sounds like living the Dream. Dream on.

beninsydney 4y ago

I'm looking forward to quitting the App Store once sideloading is allowed, once I can get my iPhone software from GitHub I won't go back to apps vacuuming up my data under Apple's oversight.

adammenges 4y ago

I’m not interested in starting a flame war, but am interested to know how many of the users who were being tracked everywhere they go without the app being opened were iOS users and how many were android. Unfortunately the post doesn’t go into much detail.

ccouzens 4y ago
If you search for Android or iOS within this page, practically everything that happens for one happens for the other https://www.priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-into-businesses/2022/pipeda-2022-001/ https://www.priv.gc.ca/en/opc-actions-and-decisions/investig... The report is about the app before September 2020. I believe location permission controls have improved on both operating systems since then.

tlavoie 4y ago

Linked from elsewhere, the original Financial Post story that triggered this specific investigation is quite the eye-opener. The reporter filed a PIPEDA request to get a copy of their own data, and then goes on to describe the findings in quite some detail. https://financialpost.com/technology/tim-hortons-app-tracking-customers-intimate-data https://financialpost.com/technology/tim-hortons-app-trackin...

april_22 4y ago

The exploitation and misuse of data by most apps we use is really sad but a reality we habe to accept. I am happy that here in the EU more and more regulations and antitrust lawsuits are being put in place.

runeks 4y ago

> The Tim Hortons app asked for permission to access the mobile device’s geolocation functions, but misled many users to believe information would only be accessed when the app was in use. In reality, the app tracked users as long as the device was on, continually collecting their location data. Why is this even technically possible? The iPhone app permissions settings has three modes: “always”, “when in use”, and “off”. I assume the second setting only allows the app to collect data when the app is actually in use? Does Android not distinguish between “always” and “when in use”?

9935c101ab17a66 4y ago
As far as I can tell, this happened between 2017-2020, so things have changed a little bit. You’re correct in that the second setting only allows an app to query native location data from the OS when the app is open but: 1) I’m assuming that’s not the scope Tim hortons asked for with their permission dialog (they lied about it, sure, by saying they would only use your location when you were using the app, but they presented the user with a prompt that granted them unfettered access). I’m guessing most users didn’t even notice, or aren’t aware of the consequences. 2) they relied on some sketchy third party company called “radar,” and I’m sure they also use heuristics beyond location data to figure out where the users are. I’d love to know if the changes apple made with iOS 14.5 would have made this more difficult? Anyway, this is disgusting and I wish there were serious, unavoidable repercussions. (Disclosure: I only skimmed the actual report, I didn’t read the whole thing)

doctor_eval 4y ago

> The investigation concluded that Tim Hortons’ continual and vast collection of location information was not proportional to the benefits Tim Hortons may have hoped to gain from better targeted promotion of its coffee and other products. Is that the standard for privacy these days in Canada? It would have been OK if the benefits to the business were proportional?