The Canadian law that I referred to in Princeton is The Personal Information Protection and Electronic Documents Act (PIPEDA), which is the national privacy law for the private sector. See http://www.priv.gc.ca/leg_c/leg_c_p_e.asp
Since the Princeton meeting, we have issued specific guidance on how PIPEDA will be interpreted for Online Behavioural Advertising (OBA). See the Guidance at http://www.priv.gc.ca/information/guide/2011/gl_ba_1112_e.asp and a background document and policy position at http://www.priv.gc.ca/information/guide/2012/bg_ba_1206_e.asp .
The guidelines describe how opt-out consent for OBA will be considered reasonable if certain conditions are met, including adequate notice, transparency, notification at or before the time of collection, easy opt-out methods that are persistent, restrictions on sensitive information such as medical or health, and avoiding the tracking or targeting of children. See the above-mentioned documents for details.
We have also conducted an enforcement action against an online social network in Canada (Nexopia) that was engaged in OBA without meeting the conditions listed above. A description of that case can be found at http://www.priv.gc.ca/cf-dc/2012/2012_001_0229_e.asp
Other compliance measures and enforcement actions are underway.
Regarding participation from Canada, we do follow developments as much as possible, and Tara Whalen from my office co-chairs the W3C Privacy Interest Group (PING).
---
Andrew Patrick, Ph.D.
Information Technology Research Analyst
Office of the Privacy Commissioner of Canada
E-mail: Andrew.Patrick@priv.gc.ca<mailto:Andrew.Patrick@priv.gc.ca>
Phone: (613) 996-6791
Mobile: (613) 219-3945