Phones, cars, watches and health applications do more than record the information a person deliberately enters. They can collect location, movement, audio, physical activity and other signals that allow systems to infer sensitive facts about daily life.
Seven Canadian research projects published through the Office of the Privacy Commissioner’s Contributions Program on November 6 examine that expanding data environment. The work covers health-related machine listening, connected vehicles, FemTech, smartwatches, youth privacy and privacy-preserving analysis.
These are independent projects funded by the federal program. Their findings and recommendations belong to the research teams and do not automatically represent enforcement findings or formal conclusions by the Privacy Commissioner.
When a voice becomes health data
A Toronto Metropolitan University team studied “health-related machine listening”: systems that derive health information from sounds such as speech, coughing, sneezing, breathing, crying or snoring.
The researchers identified more than 200 patents connected with 32 applications and examined the organizations, data subjects and uses involved. Their privacy-policy analysis concluded that the systems they studied were not meeting consent criteria established by the federal privacy regulator. That is the research team’s conclusion, not a new regulator ruling against every product in the category.
The distinction matters because an audio recording can reveal more than the words it contains. A system designed to detect fatigue, illness or emotion may create sensitive information even when the user never typed that information into a form.
Connected cars and difficult consent
The Automobile Protection Association reviewed permissions and releases associated with current-model-year 2025 and 2026 vehicles, owner manuals and automaker websites. It reported inconsistent consent practices and information that could include location, contacts, driving habits, websites visited and permission to record in-vehicle conversations.
The project also found that some in-vehicle disclosures required more than 100 scrolling screens to review and that online information could be difficult to locate or inconsistent with what appeared inside the vehicle. Some project deliverables were still listed as pending when the federal summaries were published, so the full comparison cannot yet be independently reviewed from the summary alone.
Reproductive health, watches and mobility
A University of Ottawa team evaluated nine Canadian FemTech applications against the federal private-sector privacy law. The researchers reported extensive collection of biometric and intimate data, all-or-nothing consent and cross-border storage concerns. They recommended that reproductive-health data be formally recognized as inherently sensitive.
Université de Sherbrooke researchers examined the Apple Watch, iPhone and HealthKit ecosystem, including technical safeguards, app permissions and access controls. The public federal summary describes the scope of the study but does not yet provide detailed results; its deliverables were also marked pending.
At the University of Windsor, a team tested an approach using privacy-preserving technologies to analyze connected-vehicle information without directly exposing the underlying data. The project found technical promise but also identified practical issues involving cost, performance, integration, standards and evidence that protections work as intended.
What Canadians can take from the research
The common issue is inference. A device may collect one type of signal and produce a much more sensitive conclusion. Meaningful consent therefore depends on explaining not only which raw data is collected, but what the system can derive, where processing occurs, who receives the result and how long it is retained.
The projects do not establish that every smart device violates Canadian privacy law. They do show why generic permission screens are a poor substitute for product-specific evidence. They also give regulators, developers and consumers a clearer list of questions to ask.
Those current consumer-data questions sit beside Canada’s broader work on frontier AI safety. Model-level safety and day-to-day privacy are related, but neither can substitute for the other.