The four privacy authorities recommended that Tim Hortons:
Delete any remaining location data and direct third-party service providers to do the same;
Establish and maintain a privacy management program that: includes privacy impact assessments for the app and any other apps it launches; creates a process to ensure information collection is necessary and proportional to the privacy impacts identified; ensures that privacy communications are consistent with, and adequately explain app-related practices; and
Report back with the details of measures it has taken to comply with the recommendations.
Tim Hortons agreed to implement the recommendations.