PIPEDA Findings #2021-005: Staying signed in by default to email services poses serious privacy concerns for users accessing their email on a public or shared computer
The complainant alleged that Yahoo! Canada's default "Stay signed in" setting for Yahoo Mail, particularly for Rogers Yahoo Mail users, posed significant privacy concerns on public or shared computers. The OPC investigated whether Yahoo adequately safeguarded against unauthorized access and obtained valid consent for potential disclosures. The OPC found that Yahoo's safeguards were not appropriate for the sensitivity of email content and that its consent for the "Stay signed in" setting was not meaningful. Yahoo committed to changing the setting to opt-in and providing clearer information about privacy implications. Rogers, while not a respondent, also agreed to implement measures for Rogers Yahoo Mail users. The complaint was found to be well-founded and conditionally resolved.
- 1Whether Yahoo's safeguards against unauthorized third-party access to email content on public or shared computers were adequate under Principle 4.7 PIPEDA
- 2Whether Yahoo obtained valid and meaningful consent for the disclosure of personal information to others who subsequently access emails via the "Stay signed in" setting under Principle 4.3 PIPEDA
- 3Whether the "Stay signed in" setting was clearly and prominently displayed
- 4Whether a reasonable person would understand the "Stay signed in" setting to be "on" by default
- 5Whether the "Stay signed in" setting is consistent with industry standards
- 6Whether Yahoo's additional safeguards (algorithm, sign-out option, session expiration, password reset, security information) were effective
- 7Whether express opt-in consent was required for the "Stay signed in" setting due to sensitivity of information, reasonable expectations, and risk of harm
- 8Whether the language "stay signed in" provided users with key information for meaningful consent
- Safeguards for email: Safeguards found inadequate
- Consent for 'Stay signed in': Consent found not meaningful
- Yahoo's commitment: Yahoo committed to opt-in setting and clearer information
- Rogers' commitment: Rogers agreed to implement measures
- Complaint outcome: Complaint well-founded and conditionally resolved
Complaint well-founded and conditionally resolved
The OPC found that Yahoo's default "Stay signed in" setting failed to provide adequate safeguards appropriate to the sensitivity of email information and did not obtain meaningful consent from users. Yahoo committed to implementing corrective measures, leading to a conditional resolution.
Yahoo committed to changing its "Stay signed in" setting from opt-out to opt-in, adding a pop-up warning about shared computers, and moving the setting to the password entry page. Rogers committed that any future "stay signed in" option would be opt-in and to amend its Email Member Center to show email session history by April 2022.
- Principle 4.3 PIPEDA
- Principle 4.3.2 PIPEDA
- Principle 4.3.5 PIPEDA
- Principle 4.3.6 PIPEDA
- Principle 4.7 PIPEDA
- Principle 4.7.1 PIPEDA
- s.6.1 PIPEDA
This summary is for informational purposes only and not legal advice.
Related by meaning
Decisions with similar reasoning and facts — found by AI across statutes and jurisdictions, not just keywords.
Coverage — 13 of 14 jurisdictions searchable
Fully searchable: Ontario, British Columbia, Alberta, Saskatchewan, Newfoundland and Labrador, Northwest Territories, New Brunswick, Manitoba.
Partial (recent decisions only): Federal (Canada) (651 of 1,631), Nova Scotia (49 of 472), Quebec (6 of 7,090), Prince Edward Island (2 of 279), Yukon (1 of 75).
Coming soon: Nunavut — being re-processed for AI search.
Find decisions like this one — by meaning, not keywords.
Related by meaning is a Pro feature. Upgrade to surface conceptually similar decisions across the corpus, powered by AI.
Upgrade to Pro