By Canadian Press

Home Depot gave personal data to Meta without valid customer consent: watchdog

Jan 26, 2023 | 8:30 AM

OTTAWA — Retailer Home Depot shared details from electronic receipts with Meta, which operates the Facebook social media platform, without the knowledge or consent of customers, the federal privacy watchdog has found.

In a report released Thursday, privacy commissioner Philippe Dufresne said the data included encoded email addresses and in-store purchase information.

The commissioner’s investigation discovered that the information sent to Meta was used to see whether a customer had a Facebook account.

If they did have an account, Meta compared what the customer bought at Home Depot to advertisements sent over the platform to measure and report on the effectiveness of the ads.

Meta was also able to use the customer information for its own business purposes, including user profiling and targeted advertising, unrelated to Home Depot, the commissioner found.

Looped In

LOOPED IN WITH NIKKI OMEN: December 12, 2024

6h ago

One Man's Opinion

COLLINS: North Shore BIA working hard to develop a 'happening place'

12h ago

1000 Ways to Heal

1000 Ways to Heal: Moons

Dec 10, 2024

It is unlikely that Home Depot customers would have expected their personal information to be shared with a social media platform simply because they opted for an electronic receipt, Dufresne said in a statement.

He reminded companies that they must obtain valid consent at the point of sale to engage in this type of activity.

“As businesses increasingly look to deliver services electronically, they must carefully consider any consequential uses of personal information, which may require additional consent.”

Home Depot told the privacy commissioner it relied on implied consent and that its privacy statement, available through its website and in print upon request at retail outlets, adequately explained the company’s use of information. The retailer also cited Facebook’s privacy statement. 

The commissioner rejected Home Depot’s argument, saying the privacy statements were not readily available to customers at the checkout counter, adding shoppers would have no reason to seek them out.

“The explanations provided in its policies were ultimately insufficient to support meaningful consent,” Dufresne said.

He recommended that Home Depot stop disclosing the personal information of customers who request an electronic receipt to Meta until it is able to put in place measures to ensure valid consent.

Home Depot fully co-operated with the investigation, agreed to implement the recommendations and stopped sharing customer information with Meta in October, the commissioner said.

This report by The Canadian Press was first published Jan. 26, 2023.

———

Meta funds a limited number of fellowships that support emerging journalists at The Canadian Press.

The Canadian Press