Abstract: Canadians often hold a special place in their hearts for Tim Hortons, but what if Tim Hortons began collecting sensitive data without telling its customers? This is exactly what was revealed in the summer of 2022. Tim Hortons’ mobile app collected data, including precise geolocation, from users who downloaded it to their smartphones without telling them about the tracking. When Tim Hortons released its updated mobile app, it promised customers a new way to interact with the coffee and restaurant chain while receiving promotions and coupons for their favorite menu items. Customers knew some data would be recorded – their order history and favorite menu items, to name a few – but they did not know the app was continuously tracking their geolocation data, even when closed. These data were then used by Tim Hortons to create targeted advertisements based on whether the user was walking, cycling, at home, or at work. Collecting data this way is illegal, and Tim Hortons eventually faced four class-action lawsuits and settled for roughly what might amount to C$30 million. This payout would be in the form of free drinks and donuts to affected customers. The reader is left to consider whether this was enough compensation, and how Tim Hortons can prevent, or be prevented from, illegally capturing customer data in the future.

Keywords: Privacy, Ethics, Transparency, Application development

Download This Article: JISE2026v37n4pp455-463.pdf

Recommended Citation: Royston, B. G., & Ensign, P. C. (2026). Teaching Case: The Data and the Donut – Tim Hortons Mobile App and Non-Consensual Collection of Private Information. Journal of Information Systems Education, 37(4), 455-463. https://doi.org/10.62273/MQEA6197