Technologists for Democracy (TfD) stands with the residents of 105 Isabella Street in Toronto and with Javier Ruiz-Soler. His complaints have led the Office of the Privacy Commissioner of Canada to investigate and find that MetCap “is inappropriately collecting personal information from inside the tenants’ units.” The Commissioner also found that:
MetCap failed to provide Ruiz-Soler with access to his own personal information,
MetCap failed to provide contact information for their privacy officer, and
MetCap’s public documents did not explain how video footage is managed.
Ruiz-Soler says his concerns went unaddressed for years.
Excerpt of the report by the Office of the Privacy Commissioner of Canada.
MetCap’s VP of Operations, Michael Guyette, said the company “acknowledges the seriousness of the concerns raised and has taken steps to address them.” But if this is the case, after tenants raised their concerns with the building manager, why did it take a complaint to the federal regulator for MetCap to act?
The same issues have shown up at another MetCap building. In March 2026, one of TfD’s volunteers asked for their CCTV policy. MetCap replied that per their own policy, “camera footage is not allowed to be released to the tenants.” We then wrote to MetCap’s privacy office and received a draft policy that was “not yet finalized.” We raised concerns about operating cameras without a finalized policy, and with the draft itself. We did not receive any relevant answers. In our last correspondence with MetCap, they indicated that the building was no longer being managed by MetCap.
The policy now on MetCap’s website is essentially that same draft, and none of our points have been addressed. It provides no details on retention period, states nothing about audio, and does not specify where footage is stored. It also states that requested footage showing anyone other than the requesting resident “will not be provided.” The OPC guidance says otherwise: “Individuals have the right to access images relating to them. When disclosing recordings to individuals who appear in them, the organization must ensure that identifying information about any other individuals on the recording is not revealed. This can be done through technologies that mask identity.”
Tenants have a right to know what is being recorded, why it is being recorded, how long it is kept, where cameras are, and who sees it. A company of this size can afford to pay someone whose job is to know the basics of Canadian privacy law.
Dear Chief Privacy Officer at Cineplex Digital Media:
We are writing to you with regards to privacy concerns surrounding your usage of Anonymous Video Analytics (AVA) in digital signage near Union Station Bus Terminal (USBT) and elsewhere in Canada. We represent both technologists and regular Canadians who see the value in innovation and technological development for public good.
In 2020, the Office of the Privacy Commissioner of Canada (OPC), as well as the privacy commissioners for Alberta and British Columbia, released a report on a case involving use of AVA technology by Cadillac Fairview (CF) in 2018.1 The report found that CF’s AVA deployment constituted a violation of privacy, and that “express opt-in consent would be required, as they determined that some of the information involved was sensitive and its surreptitious collection in this context would be outside the reasonable expectations of consumers.”2
We have a number of concerns relating to the aforementioned report and would like some clarifications.
Concern 1: How has the joint investigation conducted in 2020 by the Offices of the Privacy Commissioner of Canada, Alberta and British Columbia affected CDM’s deployment of AVA technology?
Concern 2: A Toronto Star article by Kevin Jiang also mentions that CDM has consulted with the OPC for this project.3 How has this consultation mitigated some of the privacy issues that have arisen in the use of AVA?
We also have concerns with certain statements in the privacy notice affixed to AVA-enabled digital signage by Cineplex (CDM).4
Statement 1:This media unit runs anonymous software, used to generate statistics about audience counts, gender and approximate age only.
Concern 3: What is the intended meaning of the phrase “anonymous software” per Statement 1 (also see Figure 1 in the Appendix)?
Statement 2:Images are processed in a few milliseconds before being immediately and permanently deleted.
Concern 4: If images are processed in the matter of milliseconds before being permanently deleted, this implies that images are only processed on-device, as opposed to being sent to a remote server or cloud service. Are images processed on-device?
Concern 5: Is any personally identifying information or biometric data collected, inferred, extracted or stored beyond statistics on audience counts, gender and approximate age?
Concern 6: Does the data collected by AVA reside in Canada?
Concern 7: What measures are in place to protect data privacy during transfer and storage of data in remote servers or cloud facilities?
We also have a number of concerns with certain statements in your notice of disclosure:5
Statement 3:We ensure that the public is well informed as [sic] the presence of anonymous video analytics systems by placing signage and stickers on kiosks, at property entrance, exit ways and other places along the path to the property.
Concern 8: Upon an investigation of Union Station Bus Terminal in early November 2025 by members of Technologists for Democracy, no warning of AVA systems was found except those attached to display signage themselves. This runs contrary to the above statement.
Statement 4: Camera sensors are installed in plain sight and are never hidden. We want the public to understand exactly where they are placed so, if they chose, they can avoid it.
Concern 9: Cameras attached to Cineplex’s digital signage are visible but quite small and difficult to identify. Over 90% of the general public interviewed by members of Technologists for Democracy were not previously aware of cameras attached to said signage. Areas where the digital ads are currently placed adjacent to USBT are unavoidable for individuals passing by in hallways coming from Union Station (i.e., two digital ads are placed very close to a train timetable, while the other is facing an entrance to USBT itself). This and concern 8 run contrary to the statements that cameras are “in plain sight”, “never hidden” and “if they [the public] chose, they can avoid it.”
We also have a number of concerns with certain statements in your privacy policy:6
Statement 5: Other Uses: We may also use Personal Information, where necessary, for: establishing, maintaining and/or fulfilling relationships with our business partners, third-party vendors of products and/or services, as well as our corporate and business customers;
Concern 10: Are images of individuals sold to any third parties?
Concern 11: Are statistics on audience counts, gender and approximate age sold to any third parties?
Concern 12: Are any other data collected by AVA sold to third parties?
Statement 6: Cineplex may also share Personal Information necessary to meet legal, audit, regulatory, insurance, security or other similar requirements. For instance, Cineplex may be compelled to disclose Personal Information in response to a law, regulation, court order, subpoena, valid demand, search warrant, government investigation or other legally valid request or enquiry. We may also share information with our accountants, auditors, agents and lawyers in connection with the enforcement or protection of our legal rights.
Concern 13: If data collected by AVA systems or digital signage is requested and sent to third parties for legally valid requests or enquiries, is there a mechanism for informing the public?
Concern 14: If data collected by AVA systems or digital signage is requested and sent to third parties for legally valid requests or enquiries, is there a mechanism for third-party audits of such data requests or enquiries?
Concern 15: It has been reported that CDM is being sold to US-based Creative Realities,7 who will take over ad billboards spanning malls and office buildings. Per this deal, will Creative Realities also take ownership of AVA systems?
We request that Cineplex Digital Media provide clarity on:
How you are ensuring that individuals captured by AVA systems remain anonymous.
How you are ensuring individuals are properly informed of recording and facial detection performed on premises.
Your data policy and transparency around sharing of information to third parties.
How your AVA system differs from Cadillac Fairview’s AVA system involved in the joint investigation conducted in 2020 by the Offices of the Privacy Commissioner of Canada, Alberta and British Columbia.
Innovation does not have to come at the cost of personal privacy. We are concerned with the lack of clarity surrounding the privacy notice and the privacy statements in CDM’s website. We are also alarmed at the prospect of a foreign company taking over CDM’s ad billboards to service software that may operate outside of Canadian laws and regulations.
We would greatly appreciate a response within 10 business days. Please reply to this email or reach out directly to Khasir Hean at khasir.hean@gmail.com / 226-927-2677 if you have any questions or would like to discuss details further.
One of the digital billboards that are performing facial detection at Union Station Bus Terminal.
In early November, a Redditor discovered that ads at Union Station Bus Terminal have tiny cameras attached. The small privacy notice on the ads indicated that they run “anonymous software” to “generate statistics about audience counts, gender and approximate age”. Visiting their website tells us that they perform facial detection on anyone nearby!
The privacy notice in question.
CDM Cineplex Digital Media
This media unit runs anonymous software, used to generate statistics about audience counts, gender and approximate age only.
To ensure your privacy, no images and no data unique to an individual person is recorded by the camera in this unit. Images are processed in a few milliseconds before being immediately and permanently deleted.
More information on the anonymous software and our Privacy Policy can be found at
Volunteers at TfD have written an open letter to CDM. Organizations including OpenMedia, TTCriders and More Transit Southern Ontario have signed on, calling for CDM to answer our privacy concerns.
