Commissioner’s Findings - PIPEDA Report of Findings #2013-017: Apple called upon to provide greater clarity on its use and disclosure of unique device identifiers for targeted advertising
An individual complained that Apple was using and sharing her unique device identifier (UDID) without her knowledge and consent for tracking and targeted advertising. The OPC determined that UDIDs, and later Advertising IDs (Ad IDs), constituted personal information because Apple could link them to identifiable individuals. While Apple's use of UDIDs for administrative purposes was deemed to have implied consent, the OPC initially found Apple's explanations for using and disclosing UDIDs for targeted advertising to be insufficient for meaningful consent. During the investigation, Apple phased out the use of UDIDs for advertising, introduced the resettable Ad ID, and improved its privacy policy explanations and opt-out mechanisms. Consequently, the OPC found that Apple's updated practices provided sufficient information for meaningful consent regarding the use and disclosure of Ad IDs for advertising. The complaint was found to be well-founded but resolved due to Apple's corrective actions.
- 1Whether Unique Device Identifiers (UDID) constitute personal information under PIPEDA.
- 2Whether Advertising Identifiers (Ad ID) constitute personal information under PIPEDA.
- 3Whether Apple obtained meaningful consent for its use of UDID for administration and maintenance purposes (Principle 4.3 PIPEDA).
- 4Whether Apple obtained meaningful consent for its use of UDID and Ad ID for targeted advertising purposes (Principle 4.3 PIPEDA).
- 5Whether Apple obtained meaningful consent for its disclosure of UDID and Ad ID to third-party app developers (Principle 4.3 PIPEDA).
- 6Whether Apple's explanations regarding the use and disclosure of UDID and Ad ID were sufficiently clear and understandable to ensure meaningful consent (Principle 4.3.2 PIPEDA).
- 7Whether the sensitivity of UDID and Ad ID in the context of user profiling and online behavioural advertising required express consent (Principle 4.3.6 PIPEDA).
- 8Whether the reasonable expectations of the individual were met regarding the use and disclosure of UDID and Ad ID (Principle 4.3.5 PIPEDA).
- UDID as personal information: UDIDs deemed personal information
- Ad ID as personal information: Ad IDs deemed personal information
- Implied consent for UDID: Implied consent for administrative use
- Consent for targeted advertising (UDID): Initial consent for advertising insufficient
- Consent for targeted advertising (Ad ID): Updated practices provide meaningful consent
- Complaint outcome: Well-founded but resolved
Complaint well-founded and resolved
The OPC found the complaint well-founded because Apple's initial practices regarding UDID use and disclosure for advertising lacked meaningful consent. However, Apple implemented significant changes during the investigation, including phasing out UDID for advertising, introducing a resettable Ad ID, and improving transparency and opt-out mechanisms, which resolved the OPC's concerns.
The OPC recommended that Apple provide clear, prominent, and just-in-time notice regarding the use and disclosure of unique device identifiers for targeted advertising, and ensure meaningful consent for such practices. Apple implemented these recommendations, leading to the resolution of the complaint.
- s.2(1) PIPEDA
- Principle 4.3 PIPEDA
- Principle 4.3.2 PIPEDA
- Principle 4.3.5 PIPEDA
- Principle 4.3.6 PIPEDA
This summary is for informational purposes only and not legal advice.
Related by meaning
Decisions with similar reasoning and facts — found by AI across statutes and jurisdictions, not just keywords.
Coverage — 13 of 14 jurisdictions searchable
Fully searchable: Ontario, British Columbia, Alberta, Saskatchewan, Newfoundland and Labrador, Northwest Territories, New Brunswick, Manitoba.
Partial (recent decisions only): Federal (Canada) (651 of 1,631), Nova Scotia (49 of 472), Quebec (6 of 7,090), Prince Edward Island (2 of 279), Yukon (1 of 75).
Coming soon: Nunavut — being re-processed for AI search.
Find decisions like this one — by meaning, not keywords.
Related by meaning is a Pro feature. Upgrade to surface conceptually similar decisions across the corpus, powered by AI.
Upgrade to Pro