Home improvement retailer Home Depot didn’t get customer consent before sharing personal data with Meta, which operates social media sites Facebook and Instagram, according to a new report by Canada’s privacy watchdog.
Privacy Commissioner Philippe Dufresne released the findings of his latest investigation Thursday morning.
It found Home Depot was sharing details from e-receipts since 2018 — including encoded email addresses and in-store purchase information — with Meta without the knowledge or consent of customers. The company stopped sharing customer information with Meta in October 2022.
E-receipts are an electronic copy of a paper receipt, usually emailed as a backup or to cut down on printing paper.
Home Depot was using a service provided by the social media giant called “offline conversions.”
According to the privacy report, information sent to Meta was used to verify if a customer had a Facebook account. If they did, Meta compared the person’s in-store purchases to Home Depot’s ads to gauge their effectiveness.
The program’s contractual terms also allowed it to use the customer information for its own business purposes, including user profiling and targeted advertising, unrelated to Home Depot.
“While the details of a person’s in-store purchases may not have been sensitive in the context of Home Depot, they could be highly sensitive in other retail contexts, where they reveal, for example, information about an individual’s health or sexuality,” said the report.
Home Depot said that it relied on implied consent and that its privacy statement, accessible through its website and in print upon request at retail locations, explained that the company uses de-identified information for internal business purposes.
“The explanations provided in its policies were ultimately insufficient to support meaningful consent,” Dufresne said in a release.
The privacy commissioner’s report focused on the chain’s Canada division, which operates 182 Home Depot stores across the country.
Dufresne will hold a media availability at 11 a.m. ET.