Tim Hortons App Tracked Users: What Regulators Found
A coffee app asked for permission to use your location. Regulators later found it was collecting far more than people were told, often when the app was not even open.
By Siddharth ShankarUpdated October 11, 2026On June 1, 2022, the federal privacy commissioner and the privacy regulators of Quebec, British Columbia and Alberta issued joint findings on the Tim Hortons app. They found it collected location data in the background, often every few minutes, and that user consent was not valid. The matter was found well-founded and conditionally resolved, with no penalty. See how location data exposes a home.
Your email is the key to most of your accounts. Has it already leaked?
Free · About 30 seconds · No sign-up · Email not stored
Location data is one of the most revealing things an app can collect. A series of points on a map can show where someone lives, where they work and how they travel. The Tim Hortons app case is a good example of how a familiar app can collect far more than a user expects.
What happened
The Office of the Privacy Commissioner of Canada and the privacy regulators of Quebec, British Columbia and Alberta issued joint findings on June 1, 2022. They found that the Tim Hortons app, which had been downloaded almost 10 million times from 2017 to July 2020, with 1,602,343 active users as of July 2020, collected location data in the background, often every few minutes, even when the app was closed.
Location tracking was added to the app in May 2019, and the investigation began in June 2020. The app inferred users' home and workplace locations.
How it worked
According to the findings, the permission prompt and the app's FAQs told users that location would be collected only when the app was open. In practice it was collected in the background. Because of that mismatch, the regulators found consent was not valid.
A third-party company, Radar Labs Inc., supplied the tracking technology. The regulators found the contract with it was vague and permissive about how the data could be used and disclosed. They also said de-identified or aggregated location data can still be personal information.
What was exposed
The data was a continuous trail of location points, plus inferences about where users lived and worked. Tim Hortons told the regulators that it used only aggregated data for trend analysis and never for targeted advertising. The findings treat that statement as the company's position.
The risk of this type of data is not that it is secret, but that it is revealing. Even without a name attached, a repeated pattern of overnight and weekday points can point to one household and one workplace.
How it ended
The regulators found the matter well-founded and conditionally resolved. Tim Hortons agreed to delete the location data and have its providers do the same, set up a privacy management program within 12 months and give quarterly updates. The company had stopped continuous tracking in 2020, after the investigation began.
There was no fine in the sources we reviewed. The result is an ending where a practice stopped and data was to be deleted, but where the users whose movements were logged have no stated compensation.
Quick check before you read on: is your email in a known data breach? Free, about 30 seconds.
Free · About 30 seconds · No sign-up · Email not stored
Key facts at a glance
- Findings date: June 1, 2022
- Regulators: federal, Quebec, British Columbia and Alberta
- Downloads: almost 10 million from 2017 to July 2020
- Active users (July 2020): 1,602,343
- Collection: background location, often every few minutes
- Outcome: conditionally resolved; delete data, build a privacy program, report quarterly
How to limit app tracking
1Set location to "While Using" or "Never"
Unless a feature needs it, do not give an app constant access.
2Review permissions on your phone
Go through your app list and remove location access you do not use.
3Delete apps you no longer use
An unused app can still collect data. Our guide to fitness app privacy shows how location can reveal a home.
4Read what a permission prompt actually says
The regulators found the prompt in this case did not match what the app did.
What the findings do not say
The findings do not say what the third-party provider did with the data in the end beyond the contract terms, and they impose no financial penalty. For another case where a company's data handling was ordered corrected, see the X-Mode location data order in the US.
Why this case matters
This case is about a gap between what an app said and what it did, not about a hack. No criminal broke in. The regulators found that the information a user was given did not match the data being collected, which is why they treated the consent as invalid.
It also shows how much work third-party code does inside an app. A company can build a familiar app and still depend on an outside provider's tracking technology, so the contract with that provider matters. For a user, the best defense is a short, regular review of which apps have location access and when.
To turn the lesson into action, our guides explain how fitness apps can reveal your home, what Google knows about you and why data brokers hold your information. You can also try our free find personal information exposed online.
Sources
- Office of the Privacy Commissioner of Canada: PIPEDA findings 2022-001 (Tim Hortons) (joint findings, downloads, active users, background tracking, commitments)
Frequently asked questions
Did the Tim Hortons app collect location when closed?
Yes. The regulators found it collected location in the background, often every few minutes, even when the app was closed.
Was Tim Hortons fined?
The findings in the sources we reviewed describe a conditional resolution, with deletion of data, a privacy management program and quarterly updates, and do not describe a fine.
Is aggregated location data personal information?
The regulators said de-identified or aggregated location data can still be personal information.
How can I stop an app from tracking my location?
Set location access to While Using or Never in your phone settings, and delete apps you no longer use.
See if your email has already leaked
- Checks your email against known data breaches
- Shows which sites leaked it, when, and what leaked
- We do not store the email you check
Compare data removal services
See which services work in your country, what they cost, and the free do-it-yourself route.
Compare removal services →Prefer a one-time report first? Scan My Shadow, our sister service, $9.99.