Home improvement retailer The Home Depot failed to obtain customer consent before sharing personal data with Meta, which operates social media sites Facebook and Instagram, according to a new report from Canada’s privacy watchdog. .
Privacy Commissioner Philippe Dufresne released the conclusions of its latest investigation Thursday morning.
He revealed that Home Depot has been sharing electronic receipt details since 2018 – including encoded email addresses and in-store purchase information – with Meta without customers’ knowledge or consent. The company stopped sharing customer information with Meta in October 2022.
Electronic receipts are an electronic copy of a paper receipt, usually emailed as a backup or to reduce printing paper.
The Canadian division of The Home Depot used a service provided by the social media giant called “offline conversions”.
According to the privacy report, the information sent to Meta was used to verify whether a customer had a Facebook account. If so, Meta would compare the person’s in-store purchases to the Home Depot advertisements to gauge their effectiveness.
The program’s contractual terms also allowed it to use customer information for its own business purposes, including user profiling and targeted advertising, unrelated to Home Depot.
‘Very sensitive’
“While details of a person’s in-store purchases may not have been sensitive in the Home Depot context, they could be very sensitive in other retail contexts, where they reveal, for example , information about an individual’s health or sexuality,” the report said.
The Home Depot said it relied on implied consent and its privacy statement, available through its website and printed on demand at points of sale, explained that the company uses de-identified information for internal business purposes. .
“The explanations provided in its policies were ultimately insufficient to support meaningful consent,” Dufresne said in a statement.
The company said it did not inform customers of its sharing agreement with Meta when they were at checkout before requesting an electronic receipt, due to the risk of “consent fatigue”.
Dufresne did not believe this argument either.
“Consent fatigue is not a valid reason for not obtaining meaningful consent,” he wrote.
“When customers were asked for their email address, they were never told that their information would be shared with Meta by Home Depot, or how it might be used by either company. information would have been important to a customer’s decision on whether or not to obtain an electronic receipt.”
Home Depot has agreed to implement the commissioner’s recommendations.
Complaint raised by the customer
The federal watchdog was alerted to the issue by a man who complained that while he was deleting his Facebook account, he learned that Meta had a record of most of his in-store purchases at Home Depot.
According to the report, he went to the Office of the Privacy Commissioner after receiving an unsatisfactory response from Home Depot when they falsely informed him that they had not shared his information with Meta.
The Canadian wing of The Home Depot operates approximately 180 stores across the country.
Dufresne will hold a media briefing at 11 a.m. ET.
past violation
In 2014, Home Depot disclosed a massive data breach that affected 56 million debit and credit cards. In this case, the Atlanta-based company said the hackers initially accessed its network with a third-party provider’s username and password.
Home Depot said hackers then deployed malware to Home Depot’s self-checkout systems to access card information of customers who shopped at its US and Canadian stores for months.
“Travel aficionado. Twitter scholar. Writer. Extreme coffee guru. Evil pop culture fanatic.”