The Office of the Privacy Commissioner of Canada’s investigation of Wajam Internet Technologies Inc. is an unusually detailed examination of how privacy law applies to software that collects browsing and search information, serves advertising, and reaches users through third-party software bundles.

In PIPEDA Report of Findings #2017-002, the OPC concluded that Wajam’s practices violated multiple requirements of the Personal Information Protection and Electronic Documents Act (“PIPEDA”), including requirements relating to accountability, meaningful consent, withdrawal of consent, retention, openness, and safeguards. (Report ¶¶ 127–191, 197.)

The case is particularly useful because the OPC did not examine consent simply by asking whether an “Accept” button existed. It examined the entire user experience: how the software was bundled and installed, what users were told, whether third-party distributors manipulated the installation path, what happened after users opted out of advertising, whether users could actually uninstall the software, how long their data remained, and how that information was protected.

Key points

1. A company remains responsible when third parties obtain consent on its behalf. Wajam relied heavily on third-party distributors, but the OPC concluded that problems with those distributors resulted in installations—and subsequent collection and use of personal information—without meaningful consent. (¶¶ 141–152.)
2. Consent cannot be engineered through a biased interface. The OPC criticized installation processes that obscured decline options, used pre-checked choices, labeled the privacy-protective path as an “Expert” option, or otherwise created what it called a “click-path bias towards installation.” (¶¶ 143, 150, 154.)
3. Meaningful consent depends on accurate information. Wajam’s websites and privacy materials contained inaccurate or incomplete descriptions of the software, its data practices, security, and retention. The OPC concluded that those deficiencies undermined meaningful consent. (¶¶ 156–165.)
4. Withdrawal of consent must work in practice. An uninstall mechanism is insufficient if technical problems prevent users from removing the software or if identifiers and software remnants remain after uninstallation. (¶¶ 166–171.)
5. Indefinite retention requires more than a convenient business justification. Wajam retained hundreds of terabytes of raw user information indefinitely, including information associated with users who had uninstalled the software. The OPC found that practice unreasonable and excessive. (¶¶ 177–184.)
6. Security must reflect both the sensitivity and volume of the information. The OPC found inadequate safeguards where personal information was transmitted without encryption and Wajam’s massive primary database remained unencrypted. (¶¶ 185–191.)

Background

• Wajam Internet Technologies Inc. was a federally incorporated company headquartered in Montreal. Its principal product was software marketed under the names Wajam and later Social2Search. Although the products had different brands, the OPC treated them as effectively the same software for purposes of the investigation. (¶¶ 19–21.)
• The software was promoted as a “social search” application. It was designed to capture users’ online search and shopping queries and, where a user linked a social-media account, supplement ordinary search results with content associated with friends and other social-media contacts. (¶¶ 22–25.)
• But advertising was central to the business model. Wajam generated revenue predominantly by displaying contextual advertisements to users who had installed the software. Those advertisements could be based on a user's current—or in some circumstances historical—search queries. (¶¶ 27–28.)
• Importantly, the data collection did not depend on a user creating a Wajam account or linking a social-media account. Once installed, the software detected visits to supported websites, collected search keywords, transmitted them to Wajam’s servers, and used them to display advertising. No additional action by the user was required. (¶¶ 29–30.)
• Distribution occurred principally through third parties. Wajam was bundled with unrelated free software—such as antivirus programs, PDF converters, or media players—and distributors received compensation for each unique installation. Wajam had agreements with 19 distributors as of November 2016 and had worked with more than 50 between 2011 and 2016. (¶¶ 31–32.)
• The scale was substantial. Wajam reported “hundreds of millions of installations” worldwide. Approximately one percent were Canadian installations; more than 75,000 installations occurred in Canada in July 2016 alone, followed by more than 50,000 in August. (¶ 34.)
• The Privacy Commissioner initiated the investigation on June 12, 2016, focusing initially on whether Wajam obtained meaningful consent, permitted users effectively to withdraw consent, and adequately safeguarded personal information. (¶¶ 1–5.)

Findings of violation

The OPC ultimately identified violations across several interconnected PIPEDA principles:

• Accountability — Principle 4.1.
• Identifying purposes — Principle 4.2
• Consent — Principles 4.3
• Limiting retention — Principles 4.5
• Safeguards — Principles 4.7
• Openness — Principle 4.8

The Commissioner concluded that the matters examined were well-founded. (¶¶ 127–191, 197.)

1. Accountability: privacy compliance must be demonstrable

PIPEDA Principle 4.1.4 requires organizations to implement policies and practices that give effect to the statute’s privacy principles, including procedures for protecting personal information, handling complaints, training employees, and explaining privacy practices. (¶ 127.)

• Wajam said that it used a privacy consultant as its privacy officer and had represented to TRUSTe that it maintained various privacy procedures. But when asked for evidence, the company was unable to demonstrate that many of those mechanisms actually existed or were followed. (¶¶ 54–59, 128.)
• The same problem arose with training. Wajam said employees received privacy and security training, but much of that training was described as informal and the company could not produce supporting materials or communications. (¶¶ 56, 58, 130.)

The OPC therefore found an absence of a demonstrable privacy management framework, notwithstanding the significant amount of browsing information and search-query data supporting Wajam’s business model. (¶ 131.)

It found violations of Principle 4.1.4(a), concerning policies and procedures, and Principle 4.1.4(c), concerning employee training and communications. (¶¶ 129–130.)

Practice tip: Accountability requires evidence. Having a privacy officer or saying that employees receive privacy training is not enough. Organizations should be able to produce the policies, procedures, training materials, records, and operational controls showing how their privacy program actually works.

2. Consent Principle: Bundled Installation, Misleading Interfaces, and Ineffective Withdrawal

The central issue in the case was consent.

PIPEDA requires knowledge and consent for the collection, use, or disclosure of personal information, subject to statutory exceptions. The organization must make reasonable efforts to ensure that individuals understand the purposes for which information will be used. Section 6.1 further provides that consent is valid only where it is reasonable to expect that the individual would understand the nature, purpose, and consequences of the collection, use, or disclosure. (¶¶ 132–136.)

• The OPC emphasized that particularly clear consent was required here because Wajam arrived as an unsolicited addition to unrelated software, yet immediately began collecting search-query and other information after installation. (¶¶ 138–140.)

Third-party distributors created significant consent risks

Wajam had established contractual requirements and a quality-assurance program for its distributors. Its Distribution Guidelines prohibited practices such as silent installations, misleading descriptions of downloads, and disabling security technologies. (¶¶ 69–78.)

But the system did not prevent significant violations.

The OPC reviewed communications identifying problems with 18 distributors, including silent installations, missing consent language, ineffective decline options, and unauthorized multiple-offer installations. (¶¶ 79–81, 143.)

Its own testing found similar problems. Some screens used outdated privacy language. Others made cancellation confusing or presented apparently disabled options. In another example, the user encountered a pre-checked box without an adequate explanation of how to continue installing the software they actually wanted without also installing Wajam. (¶¶ 64–65.)

Wajam knew about recurring problems with its distributors, and the OPC found its remedial efforts inconsistent. Although Wajam sometimes warned distributors, withheld payments, or required corrections, the measures were principally ex post, after problematic installations had occurred. (¶¶ 144–146.)

Nor did Wajam take adequate steps to address the position of users whose software had already been installed without meaningful consent—for example, by notifying them, obtaining post-installation consent, stopping further collection, or affirmatively explaining how to uninstall the software. (¶¶ 147–148.)

The OPC concluded that this distribution model presented “significant privacy risks” and that certain consent processes appeared designed to “confuse, obfuscate, and create a ‘click-path’ bias towards installation.” (¶¶ 149–150.)

Because Wajam's practices resulted in software being installed and personal information being collected and used without meaningful consent, the OPC found violations of Principles 4.3, 4.3.2 and 4.3.5. (¶ 152.)

Practice tip: Outsourcing the interface does not outsource responsibility for consent. Where distributors, affiliates, SDK partners, or other intermediaries obtain consent on a company’s behalf, contractual restrictions alone may not be enough. The organization needs monitoring and enforcement mechanisms capable of preventing—not merely discovering after the fact—practices that undermine meaningful consent.

“Click-path” design can undermine meaningful consent

The OPC separately examined Wajam’s temporary use of multiple-offer screens, in which users could consent to the primary software and several bundled programs through a single interface. (¶¶ 66–68.)

One example presented an “Express Install (Recommended)” option that automatically installed the primary program and all bundled software. Avoiding Social2Search required selecting “Custom Install (Expert)”, after which users encountered pre-checked boxes and greyed-out text. Some programs were not even fully visible without scrolling. (¶ 68.)

The OPC concluded that these screens did not give users sufficient information to meaningfully consent and again created a “click-path bias towards installation.” (¶¶ 153–154.)

Wajam's distribution through those screens therefore violated Principles 4.3, 4.3.2 and 4.3.5. (¶ 155.)

Practice tip: Interface design is part of consent. A technically available decline option does not necessarily produce meaningful consent. Pre-checked choices, visual hierarchy, confusing labels, obscured information, or interfaces designed to steer users toward acceptance can undermine the validity of the consent obtained.

Consent also failed because Wajam's disclosures were inaccurate

The OPC's concerns extended beyond the installation interface.

Wajam marketed its product as allowing users to integrate search results with multiple social networks. But by the time of the investigation, integrations with Google+, LinkedIn, and Facebook had already been discontinued, while the websites continued to promote them. Twitter integration also ended during the investigation. (¶¶ 26, 87, 157–158.)

There were significant privacy-disclosure problems as well.

• Wajam's Privacy Policy characterized information such as IP addresses, device information, operating-system information, installed browser add-ons, and installed applications as “Non-Personal Information,” even though the information was linked to individual users. (¶ 89.)
• Wajam also assigned each user a unique identifier used to identify and track that user for analytics, but the practice was not adequately disclosed in the Privacy Policy. (¶ 90.)
• Other undisclosed or inadequately disclosed practices included collecting geolocation information, collecting limited browsing history from before installation, and continuing to collect search queries even when users opted out of advertising. (¶¶ 91–93.)
• The OPC also found misleading statements about security and retention. Wajam represented that it used “modern cryptography,” while some information was transmitted without encryption and its primary database was unencrypted. It suggested that information would be retained only as long as needed, while raw user information was actually retained indefinitely, including after uninstallation. (¶¶ 159–160.)

The OPC concluded that inaccurate and misleading disclosures could materially affect a user's decision both to install and to continue using the software. Wajam therefore failed to obtain meaningful and valid consent, contrary to Principles 4.3 and 4.3.5. (¶ 161.)

Because important purposes and practices were also missing, incomplete, or inaccurate at or before collection, Wajam violated Principles 4.2 and 4.3.2 as well. (¶¶ 162–165.)

Practice tip: Consent must track the product that actually exists. Privacy policies, consent screens, FAQs, product descriptions, and security representations should reflect current functionality and actual data practices. Materially outdated disclosures can undermine the consent obtained through them.

Withdrawal of consent must actually stop the processing

PIPEDA Principle 4.3.8 permits individuals to withdraw consent, subject to legal or contractual restrictions and reasonable notice. (¶ 166.)

Wajam offered uninstall instructions, videos, FAQs, and customer-support assistance. The OPC acknowledged those measures. (¶ 167.)

But users repeatedly complained that they could not successfully remove the software. The OPC also found that antivirus software could interfere with Wajam's uninstaller and that Wajam had not adequately explained the workaround proactively. (¶ 168.)

Its testing revealed another problem: after an apparently successful uninstall, software code could remain in a browser cache and cause the browser to contact Wajam's servers again, resulting in additional collection of personal information and continued advertising. Unique user identifiers could also remain on users' devices after uninstallation. (¶¶ 101–104, 169–170.)

The OPC concluded that these problems prevented users from effectively withdrawing consent, violating Principle 4.3.8. (¶ 171.)

Practice tip: Test withdrawal end to end. A privacy control should be evaluated by its result, not merely by whether an uninstall button or opt-out mechanism exists. Organizations should test whether withdrawal actually terminates the relevant collection and removes identifiers or other components that are no longer necessary.

The uninstall process created an additional privacy problem

The investigation uncovered an especially unusual problem during uninstallation.

In approximately 10% of the OPC's test uninstallations, users were presented with unsolicited advertisements, potentially unwanted programs, or fake software offers through a third-party advertising network. Wajam's own source code called the network when users reached the post-uninstallation page. (¶¶ 105–107.)

The OPC concluded that interacting with this material could potentially expose personal information to third parties through malicious means without consent. It was particularly troubling because these were users attempting to withdraw consent from Wajam. (¶¶ 172–173.)

Wajam said it did not know about the code or have a contract with the ad network and agreed to disable it. But the OPC found the company's lack of awareness of code operating within its own website and uninstallation workflow troubling and linked the problem to its broader accountability deficiencies. (¶¶ 174–175.)

The OPC found another violation of Principle 4.3. (Consent Principle) (¶ 176.)

3. Limiting Use, Disclosure and Retention Principle: Indefinite retention of raw user data was excessive.

The scale of Wajam's retention practices was striking.

• Its primary database contained all events submitted to its servers since Wajam launched in 2011 and Social2Search launched in 2016. The database contained approximately 400 terabytes of information, including raw information attributable to particular users and potentially sensitive search keywords. (¶¶ 109–110.)
• That raw information was not subject to a defined retention schedule. Wajam retained unique user identifiers and other information even after users uninstalled the software. (¶ 111.)

Management argued that identifiers helped prevent fraudulent repeat payments to distributors when the same user repeatedly installed and uninstalled the software. (¶ 181.)

The OPC accepted that retaining limited information for a short period might serve that purpose. But indefinitely retaining all user information for such a limited objective was, in its view, “unreasonable and excessive.” (¶ 181.)

The company also lacked an overall retention and destruction policy, and its Privacy Policy did not explain either why information would remain after uninstallation or how long it would be retained. (¶¶ 182–183.)

The OPC therefore found violations of Principles 4.5, 4.5.2 and 4.8. (¶ 184.)

Practice tip: Retention must be tied to purpose. A legitimate need to retain one limited data element does not justify retaining the entire underlying dataset indefinitely. Retention schedules should distinguish among data categories and establish defensible minimum and maximum periods tied to the purposes for which each category remains necessary.

4. Safeguards Principle: Encryption

PIPEDA requires safeguards appropriate to the sensitivity, amount, distribution, format, and storage of personal information. More sensitive information requires a higher level of protection. (¶¶ 185–187.)

Wajam's Privacy Policy stated that it made best efforts to use security methods and encryption when handling sensitive information. (¶ 118.)

The OPC's testing showed something different.

• Information collected immediately after installation was initially transmitted to Wajam through unencrypted HTTP connections. Search queries could also be transmitted unencrypted depending on the website through which the search occurred. (¶¶ 119–121.)
• More significantly, the company's primary database was itself unencrypted. It contained raw information attributable to specific users, including potentially sensitive search queries. (¶¶ 123, 180, 190.)

Given both the nature and sheer volume of the data, the OPC considered unauthorized access to that database a significant risk that could result in a substantial privacy breach. (¶ 190.)

It concluded that Wajam violated Principles 4.7.1, 4.7.2 and 4.7.3. (¶ 191.)

Practice tip: Safeguards scale with the dataset. Security analysis should consider not only whether individual data elements appear sensitive, but the volume of information, its linkability to individuals, its cumulative sensitivity, how long it is retained, and the consequences if the entire dataset is compromised.

Remedy and compliance recommendations

The Wajam proceeding did not culminate in an administrative monetary penalty. The OPC instead issued a Report of Findings and compliance recommendations under PIPEDA.

The preliminary report contained twelve recommendations designed to address the identified deficiencies (¶ 194.). Among other things, the OPC called for Wajam or its successor, as appropriate, to:

• establish a documented privacy accountability framework and employee training program;
• stop using third-party bundled distribution unless adequate measures could ensure meaningful consent;
• establish procedures for addressing users whose software had been installed without meaningful consent;
• correct inaccurate website and privacy disclosures;
• fix the un-installation process and ensure unique identifiers were deleted;
• provide clearer instructions concerning complete removal;
• eliminate the problematic advertising associated with un-installation;
• delete personal information belonging to users who had uninstalled the software in accordance with proper retention schedules;
• safeguard personal information during transmission; and
• encrypt the primary database.

The corporate situation complicated the remedy.

During the investigation, Wajam decided to cease operations and transfer its software and other assets to Iron Mountain Technology Limited (“IMTL”), a newly created Hong Kong company. (¶¶ 45–52.)

Following the preliminary report, Wajam told the OPC that the transaction had been completed and that it no longer controlled IMTL, meaning it was not in a position to implement the recommendations. Wajam did, however, agree to securely destroy the hard drives and personal information remaining in its possession. (¶¶ 195–196.)

The Commissioner made clear that moving the software outside Canada did not necessarily place future operations beyond PIPEDA. If IMTL's activities had a “real and substantial connection to Canada”—for example, if it marketed the software in Canada or collected, used, disclosed, or retained Canadians' personal information—the OPC stated that it would expect IMTL to comply with PIPEDA. (¶¶ 198–200.)

Conclusion

Wajam shows that meaningful consent is about the entire user experience—not just an “Accept” button. The OPC looked at how the software was presented, whether users could realistically decline it, whether disclosures were accurate, and whether users could later withdraw consent effectively.

The case is also a reminder that accountability must be demonstrable. Contracts, policies, and a privacy officer were not enough where Wajam could not show that its controls worked in practice.

Finally, consent did not cure Wajam’s separate retention and security failures. Indefinite retention of roughly 400 terabytes of raw user data and an unencrypted primary database created independent PIPEDA violations.

For software companies using distributors or bundled installations, Wajam is ultimately about control: over consent, third parties, disclosures, withdrawal, retention, and data security.

Sources

Office of the Privacy Commissioner of Canada

• PIPEDA Report of Findings #2017-002, Canadian adware developer Wajam Internet Technologies Inc. breaches multiple provisions of PIPEDA (Aug. 17, 2017). The Office of the Privacy Commissioner of Canada's investigation and findings concerning Wajam's accountability, consent, retention, safeguards, and openness practices. Read the Report.

Relevant PIPEDA provisions

The Report applies the fair information principles contained in Schedule 1 of PIPEDA, particularly:

• Principle 4.1.4 — Accountability;
• Principle 4.2 — Identifying Purposes;
• Principles 4.3, 4.3.2, 4.3.5 and 4.3.8 — Consent and withdrawal of consent;
• Principles 4.5 and 4.5.2 — Limiting Use, Disclosure, and Retention;
• Principles 4.7.1–4.7.3 — Safeguards; and
• Principle 4.8 — Openness.

The Report also applies PIPEDA § 6.1, under which consent is valid only where it is reasonable to expect that the individual would understand the nature, purpose, and consequences of the collection, use, or disclosure.

Related Reading from The de la Torre Review

• Canada’s Federal Private-Sector Privacy Law: The Personal Information Protection and Electronic Documents Act (PIPEDA). An overview of PIPEDA's application to private-sector organizations, its fair information principles, consent requirements, and the role of the Office of the Privacy Commissioner of Canada. Read the Article.