Lisa Clyburn knew she had found the perfect gift for her nine-year-old son: a feline-themed logic game that would appeal to his passion for cards and cats.

But when the Edmonton child psychologist pulled out her phone to show her son a funny cat video on Facebook, she fears she may have inadvertently tipped him off to the Christmas Day surprise after an ad for the present she had just ordered online popped up in her feed, catching the boy's eye.

"It wouldn't have been on his radar had he not seen it," Clyburn said with a sigh. "I wanted it to blow his mind that mom found this cool game that I knew that he would like."

Clyburn is one of a number of social media users who say they've been burned by online advertisements spoiling romantic getaways, season tickets and even an engagement ring, with some internet shoppers taking precautions such as searching for decoy gifts in order to throw their loved ones off the scent this holiday season.

But experts say it's not only surprises that are at risk of being exposed as tech companies and retailers develop increasingly sophisticated tools to target users with online advertisements.

University of Toronto marketing professor David Soberman said the practice of collecting information about consumers in order to target them with ads is about as old as the industry itself. But the online age has provided companies with a trove of personal information that allows them to target consumers with a degree of precision that can at times feel unsettling.

Soberman said companies build consumer profiles by tracking their online movements linked to an IP address, a unique identifier for each computer using the internet, and through cookies, which are tiny text files that allow websites to log a user's visits and activity. Advertisers can also use data that people volunteer when creating a profile for a website or app — such as name, age and location — so when a user signs in to their account on a new phone or computer, their surfing habits can be tracked across devices, he said.

Ideally, these personalized advertisements should create value for both the seller and the buyer, said Soberman.

Agreeing to be tracked

The small share of ads that pique users' privacy concerns are only a symptom of a much broader problem, which is that people don't understand that they signed up for being tracked when they checked off the box agreeing to a website's terms and conditions, he said.

"I think that what ends up happening is that it's only when we feel something's done that we feel isn't quite right, that you'll have a situation where you're not happy," said Soberman. "A lot of people are agreeing to things, then they get upset afterwards."

Vance Lockton, a strategic analyst at the Office of the Privacy Commissioner of Canada, said the privacy watchdog takes two primary considerations into account in monitoring the online ad market — the sensitivity of the information, and the reasonable expectations of the individual.

Most online advertising is based on an "opt-out" model of consent, said Lockton, which means companies can assume that they are permitted to track users' behaviour for marketing purposes, but have to give them an option to withdraw from being targeted.

On platforms like Google and Facebook, all it takes is a few clicks for a user to view and change their ad settings, and the Digital Advertising Alliance Of Canada offers a tool that allows users to opt out of targeted ads from a number of networks.​

But Lockton said federal law sets a higher bar of "opt-in" consent for online advertisements based on sensitive subjects that a user would expect to remain private, such as health and financial information, requiring that users explicitly agree to being served with ads about these topics based on their search history.

In a 2015 study, the privacy commissioner's office examined 9,000 ads and found that three per cent were targeted based on previous searches. Of those roughly 300 targeted ads, investigators found that 34 were based on sensitive searches such as "pregnancy test," "women's shelter" or "depression cures."

Even if the scale of the problem seems relatively minor, Lockton said the impacts of this information being revealed can be far reaching.

What's sensitive?

He said the regulations also don't account for the swaths of information that depending on the context, could be considered sensitive.

"There's no bright-line test to say what is sensitive and what's not," he said. "An engagement ring ... [is] certainly something that I would say it isn't obvious to me one way or the other whether it's sensitive. A case certainly could be made that it would be."

For Eric Morris, director of Google Canada's retail business, these distinctions are crystal clear. If an online shopper is looking for an engagement ring, they may want to be exposed to offers from different jewellers to find the best cut and price for the occasion, he said, and it's up to the user to keep their browsing secret from their hopefully soon-to-be-betrothed.

"We do differentiate between engagement rings and what we call sensitive information, whether it's related to health or someone's financial information," he said, adding that one can find a list online of sensitive categories where the company has made that distinction.​

For sensitive categories including health care and financial services, Morris said Google has strict policies in place to prevent information about a user's personal hardships, identity and beliefs and sexual interests from being revealed through targeted advertising. He said Google has developed artificial intelligence technology that can filter out ads with sensitive information, and human staffers also review ads to ensure that users' privacy is being protected.

A Google Canada spokesperson ended the phone interview when Morris was asked whether ads that may bypass the tech giant's sensitivity screening would constitute a violation of users' privacy. Google said Morris was not the right person to answer questions about what kinds of information Google collects about users for the purposes of targeted advertising.

Ramona Pringle, director of Ryerson University's Innovation Studio, said tech companies are often opaque about their targeted advertising practices, but if an online service seems "free," it's safe to assume it's your information the business is selling.

"Any time you see a new feature being invented or being introduced, we should ask ourselves: How are they able to collect new information on me using this tool?" said Pringle.

As intrusive as they may seem, targeted advertisements provide a window into the scale of information that companies are collecting about users, a fact many people otherwise seem to forget when scrolling through cyberspace.

"We live in the information age, and part of that means ... that information is in our face even when we're not looking for it, or we're trying to keep it from people," Pringle said.

"There's been interesting cases where businesses know more about people than those people might have even revealed to their family members and their closest friends."