Office of the Privacy Commissioner of Canada Releases Results of Investigation into Home Depot Sharing Customer Data without Consent

On January 26, 2023, the Office of the Privacy Commissioner of Canada (OPC) announced the results of its recent investigation into Home Depot of Canada Inc. (Home Depot), finding that Home Depot forwarded customer information to Meta without customers’ knowledge or consent.

The OPC’s investigation revealed that since 2018, Home Depot collected customers’ email information at checkout for the stated purpose of providing an electronic copy of their receipt, and would then forward customers’ encoded email information and information regarding their in-store purchases to Meta. The email information would be used to determine whether a customer had a Facebook account, and if so, their purchase information would be used to determine the effectiveness of Home Depot’s advertisements delivered over Facebook. Meta would provide the results of its analysis back to Home Depot in the form of an aggregated report. Meta could also use the customer information for its own business purposes, including user profiling and targeted advertising.

The OPC did not agree with Home Depot’s assertion that it had obtained implied consent, and rejected Home Depot’s reliance on its online privacy statement along with Facebook’s privacy statement. While Home Depot’s privacy statement specified that Home Depot used “de-identified information for internal business purposes, such as marketing, customer service, and business analytics” and that it “may share information for business purposes” including “with third parties”, the OPC maintained that it did not adequately explain Home Depot’s practices and it was not readily available to customers at checkout. The OPC also found that “customers would have no reason to refer to the aforementioned privacy documents to obtain further information on a practice they are unaware of”.

In addition, the OPC did not accept Home Depot’s explanation that it did not notify customers of its information sharing agreement with Meta due to the risk of “consent fatigue”, finding that Home Depot failed to obtain valid meaningful consent for its disclosure of customer information to Meta, to be used for Meta’s own purposes.

The OPC issued several recommendations, including that Home Depot:

• cease disclosing customers’ personal information to Meta until it implements measures to ensure valid consent;
• implement measures to obtain express, opt-in consent from customers prior to sharing the information with Meta, should it recommence this practice; and
• amend privacy communications to ensure transparent messaging and meaningful consent.

The OPC noted that Home Depot was cooperative throughout the investigation, agreed to implement the recommendations, and stopped sharing customer information with Meta in October 2022.

The OPC’s full report can be found here.

Summary By: Steffi Tran