12 Aug 2020, 09:00

Privacy Commissioner John Edwards says Trade Me did not fully meet its obligations under the Privacy Act to take all reasonable steps to ensure that its members were aware of the purpose for which their information was being collected and how their preferences to “opt out” of marketing would be given effect.

But the Commissioner’s inquiry into Trade Me’s 2019 privacy policy change also found the online trading platform had otherwise acted consistently with the Privacy Act by not repurposing or using the customer information it had collected prior to its controversial privacy policy update.

Changes to the opt out policy

In September 2015, Trade Me provided members with the ability to opt-out of targeted advertisements. In early 2019, a team within Trade Me queried whether the existing practice of excluding members who had opted out from targeted onsite advertising about Trade Me services was consistent with the opt-out policy.

Trade Me reviewed the application of the opt-out policy and concluded that it had been overly broad in its application. In November 2019, the company informed its members it was updating its privacy policy for Trade Me marketing on Trade Me channels.

The update clarified that Trade Me may use personal information provided by members to target advertisements to members about Trade Me services. The update included members who had earlier elected to opt out from their personal information being used for marketing or advertising purposes.

Targeted advertisements – opt outs

Of the approximately 4.8 million Trade Me memberships, 320,823 opted out of receiving targeted advertising of some description. Some users believed that the opt-out acted as a limitation on the ability for Trade Me to target its own advertisements to its members.

“Trade Me’s targeted advertising opt-out was positive and privacy protective and looks to respect the preferences of members. There is a clear demand for privacy enhancing solutions as demonstrated by the number of individuals who used Trade Me’s opt-out.”

But Mr Edwards said Trade Me did not take all reasonable steps to communicate how members’ information would be used. “Trade Me failed to clearly inform individuals of the purpose for which their information was being collected and who the recipients of that information would be. This caused confusion and a backlash among some members who had used the opt out.”

Response from Trade Me members

Mr Edwards said the responses his office received about this inquiry from affected members highlighted the need to communicate clearly with members. The feedback received during the inquiry reflected Trade Me members’ high expectations of privacy from the online trading platform – particularly in view of the company’s privacy-conscious reputation as a Privacy Trust Mark holder for its transparency reporting work. 

“The lessons learned here are applicable to all businesses; there could be reputational harm to a business if it fails to meet its customers’ privacy expectations. I encourage all organisations and businesses to consider how they can better design their services to be privacy enhancing for their customers.” 

The Privacy Commissioner’s Inquiry into Trade Me’s Privacy Policy update and compliance with the Privacy Act 1993 report can be found here.

Contact: Charles Mabbett 021 509 735