Home Depot shared customer data with Meta for years without consent: Privacy commissioner

Article content

OTTAWA – Home Depot shared customers’ personal data with Facebook’s parent company Meta without their knowledge or consent for years, the federal privacy commissioner revealed Thursday.

Article content

“When customers were prompted to provide their email address, they were never informed that their information would be shared with Meta by Home Depot, or how it could be used by either company. This information would have been material to a customer’s decision about whether or not to obtain an e-receipt,” commissioner Philippe Dufresne said in a statement.

Article content

Starting in 2018, each time a customer provided Home Depot with their email address in order to receive an electronic receipt, the hardware company then provided it, as well as “high-level details” about the client’s in-store purchases, to Meta. The report noted that Home Depot never sought meaningful consent from its customers before doing that.

“Each email address Home Depot shared with Meta was encoded so that it could not be read by individuals at Facebook. Meta employed an automated process that allowed it to match email addresses attached to Facebook accounts. Email addresses not already associated with a Facebook account could not be linked to individuals,” reads the report.

“While the details of a person’s in-store purchases may not have been sensitive in the context of Home Depot, they could be highly sensitive in other retail contexts, where they reveal, for example, information about an individual’s health or sexuality.”

The commissioner recommends that Home Depot stop the practice, which it did in October 2022.

More to come.