Could I just add one little point? It is really important to distinguish between anonymous, targeted advertising where what you're trying to do is serve the ads to people who would be closest to their interests. So if they've been browsing auto sites, they are going to get auto ads. If they have been browsing skiing sites, they're going to get skiing ads. If that's done completely anonymously and is just based on their browsing habits, it's pretty benign. The only criticism I've ever heard, and you've probably heard it, is that some people find it creepy, which is not exactly a phrase I've seen in PIPEDA or any other legislation.
The thing you have to worry about is where those particular profiles are then matched with offline information and then brought into a profile that allows you to identify people. That can be a problem, and that is something that has to be closely looked at, but those are two very different problems. Sometimes you have to be careful not to mix the two.