The following article first appeared in the Toronto Star on November 5, 2025.
A social media post drew outrage after highlighting billboards recording Torontonians’ biometric data. Here’s what’s going on.
As you’re watching commercials on mall kiosks and digital billboards across Toronto, be aware that the advertisements might be watching you back.
A sharp-eyed online commentator on Reddit sparked outrage over the weekend after sharing a notice that some billboards near Union Station Bus Terminal are using facial detection technology to tailor ads to whoever’s looking.
Metrolinx later clarified to the Star that the ads were not inside the bus terminal itself, as the Reddit post suggests, but the building where the terminal is located. Metrolinx is not partnered with the company behind the ads, it said.
The notice on the billboards, owned by Cineplex Digital Media (CDM), said the devices run “anonymous software” to “generate statistics about audience counts, gender and approximate age only.”
“To ensure your privacy, no images and no data unique to an individual person is recorded by the camera on this unit,” it read. “Images are processed in a few milliseconds before being immediately and permanently deleted.”
A spokesperson for CDM said that the company sought an advisory consultation with the Office of the Privacy Commissioner of Canada (OPC) for the use of the technology, and that “we strictly adhere” to its guidance.
But that hasn’t stopped internet denizens and experts from raising alarms over the potential privacy issues caused by the so-called Anonymous Video Analytics (AVA) technology — especially when it collects sensitive information about individuals’ probable age and sex and does not solicit explicit consent from the people it’s recording.
“The justification for the technology is that no personally identifiable information is being stored,” said Charles Finlay, the founding executive director of the Rogers Cybersecure Catalyst at Toronto Metropolitan University.
“But we have to trust the private company that that is what’s happening and not something else, which is a leap of faith in terms of technology and privacy that many people may frankly not be willing to take,” Finlay said. “And it may raise legitimate concerns in people’s minds about what is being captured by these cameras.”
Is the mall kiosk recording you?
In some cases, yes.
According to CDM’s website, the company has installed camera sensors at “various malls, concourses and at retailers” capable of detecting the faces of passersby.
CDM was adamant its tech is not “facial recognition” but “facial detection.” It looks for the presence of a face but doesn’t seek to identify them, its website read.
The company that supplies the software agrees: “Our technology uses body and face detection algorithms, not face recognition. It never attempts to identify or re-identify any specific person or track individuals across multiple detections,” said Denis Gaumondie, chief marketing officer of Paris-based computer vision and AI company Quividi.
“It is designed to detect and classify a face, or person, ‘at large,’ using very generic patterns,” Gaumondie told the Star. “No data unique to an individual is ever generated. No biometric information is ever extracted from the images provided by the video sensor at any point during processing.”
But the tech is still enough to determine one’s general age and sex, which CDM said it leverages to show more “relevant and interesting” advertising to different viewers.
It’s also used for gauging engagement and audience counting, which CDM’s spokesperson said was its “primary purpose … there is no personal identification, no pictures stored, and no tracking or profiling of individuals.”
Not all the data is lost, however. Some information, like one’s age and sex, is retained and aggregated with the data collected from other passersby. CDM assured that “there is no way to link this data back to the image of your face, as this image of your face is not retained.”
But that’s difficult to promise without knowing exactly what information is being recorded, where it’s stored and how long it’s being retained, said Rozita Dara, an associate professor of computer science at the University of Guelph. “As soon as you collect data in digital format, there is always a risk,” she said.
“As soon as companies start collecting extremely sensitive information like this, even if it is aggregated, they have to also put best practices in place and train employees to make sure personal data is not misused.”
Out of everything, Dara believes the biggest issue here is the lack of “explicit, transparent consent” from passersby before they are recorded: “That, on its own, is extremely alarming.”
Has this happened before?
As a matter of fact, it has. And it didn’t end well for the company in question — largely due to a lack of meaningful consent.
In 2020, an investigation by federal, Alberta and B.C. privacy commissioners found Cadillac Fairview used facial recognition software and cameras embedded within mall kiosks to collect the images of five million shoppers across Canada.
Cadillac Fairview promised it was not collecting personal information and, like CDM, said it would only briefly analyze the images before deleting them. But privacy commissioners found the company did collect personal information — in addition to contravening privacy laws “by failing to obtain meaningful consent.”
“The lack of meaningful consent was particularly concerning given the sensitivity of biometric data, which is a unique and permanent characteristic of our body and a key to our identity,” said then–Privacy Commissioner of Canada Daniel Therrien in a release.
After the investigation, Cadillac Fairview removed the cameras from its kiosks and deleted all collected data “not required for potential litigation purposes.”
Vito Pilieci, a spokesperson for the OPC, couldn’t speak to how CDM’s case differs from Cadillac Fairview’s because he said OPC “conducts its advisory work with organizations in confidence.”
But he noted that, generally speaking, “the knowledge and consent of the individual is required for the collection, use or disclosure of personal information” under the Personal Information Protection and Electronic Documents Act, save for specific exemptions.
Gaumondie asserted his company’s technology is “radically different from the one used in the Cadillac Fairview case” because it is unable to recognize any individual it captures.
Meanwhile, CDM’s spokesperson said the company’s use of the technology aligns with Canadian privacy law and “industry best practices,” saying, “We strictly adhere to the guidance provided by the OPC, ensuring that our technology is used ethically, responsibly, and in compliance with all relevant privacy laws and regulations.”
Clarification – Nov. 6, 2025
This article was updated from a previous version to make clear that the digital billboards are in the area near the Union Station Bus Terminal. It is not located inside the actual bus terminal space, according to Metrolinx.