While appearing before the House of Commons Access to Information, Privacy and Ethics Committee on Aug. 8, Philippe Dufresne said he first learned about the RCMP’s use of the software from the media and that his office was not consulted about its potential privacy risks.

The settlement, negotiated with the legal teams involved in the lawsuits, still requires court approval.

The coffee and doughnut chain would also permanently delete any geolocation information it may have collected between April 1, 2019 and Sept. 30, 2020, and direct third-party service providers to do the same.

Ok so Tim Hortons spent more than a year silently and illegally tracking users through their mobile app, and the proposed class action settlement is … a free coffee and a donut.

I swear to fucking god. This is real. pic.twitter.com/eu8P7c2kqO

— James McLeod (@jamespmcleod) July 29, 2022

“We think that it’s a favourable settlement because it offers compensation that has a real value,” said Joey Zukran, a lawyer with the Montreal-based law firm LPC Avocat Inc., which filed the class action in Quebec.

“Privacy cases across Canada are never guaranteed a win,” he said. “Here we have some form of guarantee, some form of recovery … as opposed to uncertainty that could last.”

It’s unclear how many customers used the app during the 18-month period ending Sept. 30, 2020, and would be eligible to receive a free hot beverage and baked good.

Restaurant Brands International Inc., the parent company of Tim Hortons, said in an investor presentation in May that it had four million active users during the three months ended March 31, 2022.

“I think people who receive this will think it’s paltry, but class action settlements are often paltry for the end consumer,” said David Fraser, a privacy lawyer with McInnes Cooper in Halifax.

More trouble for Tim Hortons.https://t.co/hLQSMQxIhV

— Canadian Riley (@TiaRileyCanada) July 21, 2022

The proposed settlement comes after an investigation by federal and provincial privacy watchdogs found the mobile ordering app violated the law by collecting vast amounts of location information from customers.

In a report released last month, privacy commissioners said people who downloaded the Tim Hortons app had their movements tracked and recorded every few minutes—even when the app was not open on their phones.

The investigation was launched after National Post reporter James McLeod obtained data showing the app on his phone had tracked his location more than 2,700 times in less than five months.

Tim Hortons said it would be emailing customers Friday to inform them of the proposed settlement.

Tim Hortons said the retail value of a free hot beverage is $6.19 while the value of a baked good is $2.39, plus taxes, according to court documents.

Customers would be provided with a credit for the items with a coupon or through the Tim Hortons app, documents said.

Details on the distribution of the free hot beverage and baked good would be provided if the court approves the settlement, Tim Hortons said.

A hearing has been scheduled in a Quebec court on Sept. 6 to consider the proposed settlement.

“Our office has received and is currently investigating a complaint that raises concerns with respect to the collection of personal information through ArriveCAN and subsequent use of that information,” said the Office of the Privacy Commissioner of Canada in an email dated July 27.

In June 2020, a group of federal Conservatives also asked the privacy commissioner to investigate ArriveCAN due to concerns they had about the potential misuse of data. The privacy commissioner responded two months later and said that he reviewed the app’s privacy conditions and that he didn’t have any concerns at the time.

"The arrive can app is increasingly unnecessary, and it's hopelessly broken. So when will the government commit to ending the chaos at our borders and our airports?" pic.twitter.com/zZiw7xf5Ap

— Canadian Riley (@TiaRileyCanada) June 22, 2022

“Given the ongoing investigation and consultations, we do not have further details to provide at this time,” the privacy commissioner said.

ArriveCAN was first launched as a voluntary app in April 2020 as a way of collecting personal information needed by public health officials to enforce quarantine rules.

Its continued mandatory use has come under intense scrutiny over the past few months, especially as other public health measures fell to the wayside, such as mandatory masking and vaccine requirements.