MONTREAL (CN) – The Office of the Privacy Commissioner of Canada argued Thursday that Facebook has violated provisions of Canada’s private sector privacy law, the Personal Information Protection and Electronic Documents Act, or PIPEDA.
In 2015, a global scandal erupted after a personality quiz app on the leading social media platform was found to be collecting data from users and their friends. This information was shared with Cambridge Analytica, a political consulting firm that used the data for political profiling and targeted advertising.
Between 2018 and 2019, the Privacy Commissioner of Canada investigated Facebook under PIPEDA and concluded that users did not provide meaningful consent for their data to be shared with third-party applications and that Facebook failed to implement adequate safeguards to protect that information.
But lawyer Michael Feder, representing Facebook before the Supreme Court, said users gave their meaningful consent when they signed up and agreed to Facebook’s terms of use, which he described as laid out in “plain language”, “not legalese”.
Feder quoted the opening lines of Facebook’s terms: “Just like when you share information via email or elsewhere on the web, information you share on Facebook may be redistributed.”
But judge Andromache Karakatanis said that consent is too far-fetched.
“You’re not just sharing with friends; you’re sharing with friends who have then determined how that information can be shared with others,” she says.
Justice Nicholas Kasirer upheld this, citing the Federal Court of Appeal, which in 2024 overturned a Federal Court of Canada ruling that sided with Facebook. The appeals court reasoned that friends of the apps’ direct users would have “at best a vague and rosy view of how third-party apps might use their data.”
Facebook also maintained that the information shared — including dates of birth, locations and activities liked — is not sensitive data, such as medical information or other highly private information.
“Facebook is a social network. People choose to come to Facebook because they want to share information. No one comes to Facebook with things they want to keep secret from the world … The reason we are given likes is because someone wants the world to know,” Feder said.
But Judge Mahmud Jamal countered by explaining that while Canadians live more of their lives online, their digital trail of activities provides insight into their personal lives and political views.
“If you ask Canadians, when you participate in Facebook, do you know that your data footprint is being used to target political messages to you, to sell you things? Some may say, ‘I don’t care,’ but others may say, ‘Actually, I didn’t know that,'” he said.
Feder also argued that any problems with a third-party app’s privacy policies are the responsibility of the app’s developer — not Facebook. In this case, he pointed to Aleksandr Kogan, the creator of the “This Is Your Digital Life” app at the center of the case.
Colleen Bauman, representing the Privacy Commissioner, withdrew, arguing that Facebook failed to act on clear warning signs. In particular, the company knew the app was seeking access to user data beyond what the app needed, which Facebook’s own policies prohibited.
“Facebook acknowledged that this was a red flag, but they didn’t take any action. They continued to disclose the data for the next year,” she said.
Feder countered that Facebook had implemented safeguards and improved its platform to protect user data. Facebook’s filings detail how the company implemented the Privacy Commissioner’s recommendations from a 2008 investigation.
This included the Granular data permissions system, implemented in 2010. Under this system, when a user installed an app, they were informed about the types of information the app wanted to access, given a link to the app’s privacy policy, and could grant or deny any requested permissions. However, these safeguards were put in place before the application was created.
The debate also drew intervention from civil liberties groups.
Cynthia Khoo, a lawyer with the Civil Liberties Union of British Columbia, who attended as an intervener, highlighted the complex modern reality of social media platforms as part of a vast third-party ecosystem where companies collect and monetize personal data.
She cited examples such as social media posts being used by surveillance firms to monitor protesters or activity data feeding algorithmic models that discriminate in housing and employment.
Social media is comparable to an iceberg, Khoo said. Advice is the basic information we share: likes, posts and texts. The rest is information extracted from it: behavioral patterns, political views and more, which are sold to third parties.
“Users need to be informed about the whole iceberg, not just the part above the water. They need to be informed about the possible consequences,” she said.
The judges did not say when or how they will rule.
Subscribe to our free newsletters
Our weekly newsletter Closing arguments provides the latest on ongoing trials, major litigation and decisions in courts around the US and the world, while monthly Under the lights feeds legal dirt from Hollywood, sports, Big Tech and the arts.
