Privacy commissioner Daniel Therrien says new research released by his office reveals a small but troubling number of cases in which major websites used such sensitive information to target Internet users without appropriate consent.
Many websites track a user's online activities with the aim of delivering ads aligned to their interests.
Four years ago the commissioner's office issued guidance to advertisers advising them to avoid collecting sensitive personal information, such as health-related details, in order to deliver their ads.
The commissioner says targeted ads appeared on just over half of the websites the researchers examined, and most advertising organizations provided some form of notification to users as well as an ability to opt out of such ads.
However, a small number of targeted ads related to sensitive topics appeared without explicit consent from the user.
In addition, there were ads related to non-sensitive topics — such as European travel or digital cameras — without notification or the possibility to opt out of seeing them.
In many cases the procedures for opting out were overly complicated.
"While we found many examples of good privacy practices related to online behavioural advertising, it's clear the industry still has some work to do," said Therrien.
"Some people like online behavioural advertising because the ads they see are more relevant to their interests. However, others do not like to be tracked and targeted in this way and the opt-out procedures for them need to be clear, consistent, and usable."
The commissioner's office is following up with three advertising organizations that used sensitive information without appropriate consent.
In addition, Therrien's staff recently met with digital advertising industry members to discuss the research and encourage better practices.
Follow @JimBronskill on Twitter