Canada's privacy regulator finds that coffee shop chain Tim Hortons illegally collected customer location data via its mobile app without adequate user consent
how restaurant apps can put your privacy at risk Jim Bronskill / CTV News : Tim Hortons app collected vast amounts of sensitive data: privacy watchdogs Tweets: Pernille Tranberg / @pernillet : Tracking your location data ‘while in use’ might not be trusted. A app from popular Canadian coffee chain tracked users as long as the device was on. The app also used location data to infer where users lived, worked, and whether they were traveling https://www.bloomberg.com/... @techwontsaveus : “The location tracking ecosystem, where details of our daily lives are treated as a commodity to be exploited to sell us products and services such as a cup of coffee, heightens the risk of mass surveillance,” said Canada's privacy commissioner. https://www.cbc.ca/... Amir Attaran / @profamirattaran : Oh the irony: it wasn't the vaccine that had a tracking chip; it was Tim Hortons that all the truckers swilled. https://www.theglobeandmail.com/ ... CBC Toronto / @cbctoronto : The report says Tim Hortons collected granular location data for targeted advertising and the promotion of its products, but that the company never used the data for those purposes. https://www.cbc.ca/... Jeff Jarvis / @jeffjarvis : Et tu, Timmy? https://www.priv.gc.ca/... Timothy Burke / @bubbaprog : rrrrroll up the arrrrrrrrrraignment of tim hortons executives https://twitter.com/... @zeddary : Having recently gotten together with my many Canadian cousins for the first time since COVID I can attest that this is a bigger deal than Snowden. They have that shit open like it's twitter. https://twitter.com/... Rachel Gilmore / @atrachelgilmore : Double double? More like Double trouble! https://twitter.com/... @manan : this is important. App developers force variety of toggles without questioning “Is this critical for the purpose of the app or just good to have because the dev platform allows us to collect” https://twitter.com/... Sean Kerner / @techjournalist : Spoiler alert: Most @TimHortons app users were either on their way to get coffee/ or just coming from getting coffee. There is literally a Tims on every corner here. https://twitter.com/... @business : Tim Hortons, the ubiquitous Canadian coffee chain, violated privacy rules by tracking its customers' movements with its mobile app even when the app wasn't in use https://www.bloomberg.com/... @mikeisaac : imagining the ceo of BIG DONUT hauled into the House of Commons to testify https://twitter.com/... Kashmir Hill / @kashhill : They wanted to know when their customers were getting coffee at Starbucks instead. Canadian privacy regulator: “you can't spy on your customers just because it fits in your marketing strategy.” https://twitter.com/... Shira Ovide / @shiraovide : Why did the {checks note} donut app need to collect information on people's locations every few minutes, and make a record each time people left home or work? Just...why? https://twitter.com/...
Context & Ripple Effects
Tim Hortons’ app sits within a location-data market in which collectors, aggregators, and marketplaces monetize movement information, as documented in coverage of the location-data supply chain. The regulator’s finding makes inadequate consent a direct liability for a consumer loyalty app rather than an abstract data-industry concern.
The case later shifted from the finding to customer remediation when Tim Hortons proposed a free drink and baked-good settlement offer. That sequence ties app-data practices to both regulatory exposure and the cost of repairing customer trust.
First-order effects
- Tim Hortons must confront a regulator’s determination that its app’s location collection lacked adequate consent, putting its app-based data practices and customer relationship under immediate pressure.
- Customers whose app use generated location data gain a formal basis to challenge how Tim Hortons obtained and used that information.
Second-order effects
- Restaurant and retail app operators that use location features face pressure to make consent flows and data use more explicit, because a loyalty app can trigger the same scrutiny as a dedicated data business.
- Location-data collectors and marketplaces risk losing inputs from consumer apps when brands limit collection or require clearer permissions, constraining the supply described in the location-data market analysis.
Third-order effects
- If enforcement against app-based location collection becomes more common, consent design becomes a product and commercial constraint on loyalty programs, not merely a legal disclosure exercise.
- The case points toward a sharper boundary between consumer-facing services and the broader market for monetizing behavioral data: brands that cannot show meaningful permission may have to reduce what they feed into that market.
The trend: Consumer-app privacy enforcement is turning location consent into a constraint on the data pipelines behind loyalty and analytics products.