Dozens of MPs' websites can track visitors for targeted campaign ads

Nearly a third of MPs have trackers embedded on their official websites that could allow them to target visitors with campaign ads, an investigation by CBC News reveals.

People who visit one of those MP websites — to learn how to apply for a passport, for example, or to find a phone number for an MP's riding office — could find re-election ads for that MP popping up in their Facebook feeds, or on websites they later visit.

Using a tool that detects trackers, between Aug. 13 and Sept. 3 CBC News found that most of Canada's 334 sitting MPs have some sort of tracker installed on their official websites — the ones they've chosen to list on the House of Commons website. While some can be used to target visitors with advertising or collect behavioural data, others simply help the website run more smoothly or collect statistics on visitors.

A handful of MPs have websites but no trackers.

Overall, CBC News found that 99 MPs have advertising trackers on their websites. The CBC identified 98 of them through Ghostery, an online tool that allows users to detect trackers. (Conservative MP Erin O'Toole told CBC he also tracks visitors to his site in order to advertise on the Metroland newspaper platform.)

The use of trackers on MPs' websites raises privacy questions — particularly in the wake of the Cambridge Analytica scandal, which demonstrated how political advertising can be microtargeted toward individual voters using their online profiles. Experts say MPs also may not be aware of how much information the trackers are allowing tech companies to gather about visitors to their websites.

"It's a privacy Trojan horse, that's what it is," said Johnny Ryan, chief policy and industry relations officer for Brave Software, which makes a web browser that blocks trackers and ads.

"You install a Facebook tool on your web page, hoping it'll make your web page better in some way. What that tool is actually doing is leaking out the private behaviour of everyone who comes to that web page to Facebook, and that's what they're for."

Privacy expert Ann Cavoukian said MPs shouldn't be using trackers without the consent of those who visit their sites — and they wouldn't be able to if political parties were not exempt from privacy laws.

"I just find this practice so unacceptable, that members of Parliament are tracking the identities and the activities of individuals, Canadians who go to their websites to obtain information," she said. "What gives them the authority to collect your information, to track you and then potentially use it for advertising purposes? Totally, totally unacceptable."

Brenda McPhail, director of the Privacy, Surveillance and Technology Project at the Canadian Civil Liberties Association, said politicians have long tried to collect information from people who might vote for them. Trackers are among the newest — and least visible — tools for gathering visitor data.

"The new wrinkle to this, in some ways, is the invisibility (of) the process," she said. "It should really be incumbent on parties to make it crystal clear how information is being collected and used, and not just in privacy policies but in places that are more prominent and visible."

The practice also raises questions about whether changes are needed to Parliament's rules on how members of Parliament use their websites. While MPs are prohibited from using their MPs websites for partisan activity, such as asking for donations or campaigning to be re-elected, there are currently no rules covering the use of trackers to target advertising.

While each party has its exceptions, in general CBC News found that New Democratic Party MPs had far more trackers attached to their websites than MPs from other parties, including more advertising trackers. Most NDP MPs also deployed a similar selection of trackers.

Liberal MPs generally had the fewest trackers and the one or two trackers on the sites of most Liberal MPs are usually used for site analytics.

Conservative MPs employed a wide variety of trackers, including advertising trackers.

Some MPs unaware of trackers

In some cases, MPs contacted by CBC News were not aware that there were trackers on their websites linked to the House of Commons page.

NDP MP Charlie Angus said he was surprised to discover that his profile on the House of Commons website was linked to charlieangus.ndp.ca — a site with 12 trackers put together by the NDP — instead of his own website charlieangus.ca, which has five trackers, including the advertising tracker DoubleClick.

Not long after the CBC asked Angus about the site, his office asked the House of Commons to link his profile instead to charlieangus.ca.

Website trackers are not illegal and are used by many websites; cbc.ca and many other media websites use them for analytics and advertising. CBC spokesman Chuck Thompson said the network uses trackers to help make better decisions about serving Canadians — and new visitors to CBC pages get a notice the first time they visit letting them know that trackers are being used.

It's not clear how well the practice agrees with the House of Commons rules governing MPs' websites.

MPs are not allowed to use websites paid for by House of Commons funds for partisan purposes like fundraising or election campaigns. However, there are currently no rules governing the use of website trackers.

MPs' Board of Internal Economy (BOIE), which oversees the running of the House of Commons, acknowledged during a meeting in May that there are gaps and grey zones when it comes to what MPs can do with their websites.

Liberal House Leader Bardish Chagger, whose MP website has no trackers, said the BOIE already has decided to clarify the rules when the next Parliament starts sitting.

"Up until now, we haven't really had guidance or any structure when it comes to online platforms," said Chagger. "So we are now treading into those conversations because it's important that we have them."

Canada's political parties are currently exempt from Canada's privacy laws — something that Privacy Commissioner Daniel Therrien has said should change.

Some MPs or parties may not be able to make use of the data generated by the trackers during the election campaign. While social media companies like Facebook and Twitter will be accepting election ads during the campaign, Google (which has the DoubleClick tracker) has said it won't because it was too difficult to comply with new election advertising rules in the time provided.

How it works

When a user clicks on a website with trackers embedded, the trackers register such information as their IP address, the browser and the kind of device they're using. The trackers can use that information to identify users and follow them around the web, targeting them with marketing messages.

Companies like Facebook are quick to point out that the information collected by trackers doesn't go directly to a politician or a political party. Instead, politicians can ask Facebook to use the information it collects to target ads at people who have visited a specific website, or to target ads at an audience of people who share the same profile as a particular website's visitors.

That browsing information is valuable to tech companies because it helps them build user profiles and amass data about consumers. It also allows politicians to more accurately target advertising at people who already have visited their websites, or at people who fit a similar profile.

Dennis Matthews is vice president of the communications firm Enterprise Canada and has run advertising and marketing for Conservative campaigns. He said data is the lifeblood of modern election campaigns and predicts many successful campaigns in 2019 will be spending half of their advertising budgets on digital ads.

"If you're a campaign, you're going to want to make sure those dollars are spent as efficiently as possible," he said. "And the best way to do that is through things like the Facebook pixel and other trackers to make sure you're reaching people you know are interested in your message, or at least open to it, and putting all sorts of restrictions on geography. Everything you can do to target as specifically as possible."

What we found

Using Ghostery, CBC News looked at the websites linked to by the House of Commons for all 334 current MPs and recorded the trackers on each one.

On average, NDP MPs had the highest average estimated number of trackers on individual MPs' websites — slightly more than 10. The Conservatives were in the middle with an average of just over four trackers per site, while the Liberals had the lowest average — about two trackers per page.

The Liberal Party of Canada's webpage, on the other hand, had more trackers than its rivals — 13, compared to 12 for the NDP, eight for the Green Party, seven for Maxime Bernier's People's Party and five for the Conservatives.

NDP spokeswoman Mélanie Richer said the party handles the websites of most NDP MPs.

"Most MP pages are run by us, but a few are run by the MP's team," she said.

Richer said the party has its own proprietary website building tool that adds the trackers, but maintained that the party doesn't plan to use them in the campaign.

The Liberal Caucus Research Bureau helps many MPs with their websites; it said MPs and their offices are themselves responsible for their sites.

Hamish Marshall, head of the Conservative Party's election campaign, said his party's MPs handle their own websites.

"Anything on an MP's website is the choice of the individual member of Parliament," he said. "That's not something that, to my knowledge, we are involved in at all."

The most common trackers on the MPs' websites are those from the Facebook group of trackers — including the Facebook pixel (48 MPs) and Facebook Connect (104 MPs) — Google Analytics (175 MPs) and Google's ad management service DoubleClick (80 MPs), and Twitter Button and Twitter Syndication (113 MPs).  Facebook says that Facebook Connect is used to help people log into websites, but privacy experts Oppenheim and Ryan say it can still track your activities and gather data about you.

Optimizely, a tracker that helps website users gather data to measure engagement and site usage, was attached to the websites of 183 MPs, including most of the Liberals. 

Determining how many trackers are attached to a website can be tricky. Websites are dynamic and the number of trackers can change from one visit to the next.

"The tracking ecosystem on most websites is fairly fluid," said Jeremy Tillman, president of Ghostery.

Websites are constantly changing as their managers alter and edit content and site architecture, so trackers may be added or removed. And the presence of some trackers may trigger other trackers to load — but not in every case. Trackers can also vary depending on the user's geographic location and the time of day.

"Some trackers invite other trackers to the party, if that makes sense. We often call these piggyback trackers and, depending on the website, depending on the use case, it could be a couple or it could be dozens of trackers," said Tillman. 

For example, Conservative MP Randy Hoback's site had five trackers when it was first viewed by CBC News. The numbers varied on subsequent visits — and then the trackers disappeared completely after CBC News contacted Hoback's office with questions.

During CBC News' investigation, some websites linked to by the House of Commons changed from MP sites that discussed issues and government services to campaign re-election sites.

Shown the spreadsheet of trackers found by CBC News, online privacy expert Casey Oppenheim said the Facebook trackers likely collected the most information; he also singled out Google's DoubleClick.

"DoubleClick is Google's way of serving you ads across the web," said Oppenheim, CEO of Disconnect, a company that makes apps and browser plug-ins that help users protect their privacy and block trackers online.

"DoubleClick is a huge tracking company. Google bought them in late 2007 for billions of dollars," he said. "That's one of the biggest data collectors on the web."

The companies behind such trackers often maintain data-sharing agreements with other companies — and when those companies are credit card firms, or others that collect personal information about users' purchasing habits, they can assemble an astonishing about of personal information about an individual, said Oppenheim.

"We're not just talking about your web history. We're not just talking about ... targeted ads, right? I mean we're talking about like a huge profile of like pretty much what you're doing online and off," he said.

Ryan said it's not just Facebook pixel that's sending information to Facebook — it's also "like" buttons, "share" buttons and the "log in with Facebook" option. However, Facebook pixel is specifically used by advertisers and can be customized to gather specific kinds of information.

"I think in many cases, operators of websites, whether they're political parties or not, are not as sophisticated as Facebook and do not necessarily know what they're exposing Facebook to, as a result of using Facebook tools," said Ryan.

"Unfortunately the situation is one in which a politician and any other marketer must have their mental shields up and not trust these tech companies. You cannot take them at face value, because to do so would be to expose your constituents to tracking when they are trying to engage with you about very sensitive things that are at the core of the relationship between the politician and the state and the citizen."

McPhail said political parties should be held to a higher standard of privacy protection because of the special role they play in society.

"I think that this deep dive into the intricacies of how political parties ... track members and people who visit their sites is an excellent illustration of how very little the average person understands, or has the capacity to figure out, (about) the multiple ways in which they're being examined and watched online," she said.

"All of these practices that they're engaging in are relatively commonplace, they're relatively routine and we haven't had yet the public conversation about whether or not these things are appropriate," she said. "We have sleepwalked our way into allowing this to happen, because it's virtually invisible to us."

Elizabeth Thompson can be reached at elizabeth.thompson@cbc.ca. Andrea Bellemare can be reached at andrea.bellemare.cbc.ca