Did Home Depot share customer personal information with Meta? Court of Canada approves lawsuit

Home Depot (istock image)

Photo: iStock

The Supreme Court of British Columbia has approved a class-action lawsuit accusing Home Depot violation of customer privacy by sharing email addresses with Meta, Facebook’s parent company.

According to the lawsuit, Home Depot allegedly collected client emails while posing as an electronic receipt provider. Instead, the company gave Meta access to those emails to monitor the effectiveness of Facebook ads. Consumers claim this behavior went beyond their contractual obligations and privacy laws.

Home Depot allegedly gave Meta access to about 7 million consumer emails between 2018 and 2022. Meta’s ad analytics tool used those emails to track in-store transactions influenced by Internet ads by linking Facebook profiles. The goal of Meta’s initiative was to quantify offline purchase patterns influenced by online advertising.

Home Depot said it was aware that once the analysis was complete, Meta would remove the “hashed” email data. However, an investigation by the Ontario Privacy Commissioner (OPC) in 2021 revealed that the companies had not obtained proper user consent before sharing this data.

When a complaint tried to remove his Facebook account, he found the problem. He discovered that a record of his Home Depot transactions was in Meta’s possession. In 2022, Home Depot stopped the practice in response to the OPC’s recommendations.

Customers who provided their email addresses at Home Depot locations between May 1, 2018 and October 31, 2022, are seeking refunds in the class action lawsuit sponsored by the Merchant Law Group. The case may go to trial due to BC Supreme Court certification.

The incumbent court placed great emphasis on addressing these pervasive privacy concerns. “In the modern business landscape involving the use of personal information,” the judge wrote, “each individual may have limited ability to protect their rights.”

All affected customers in Canada are eligible to participate in this action. If successful, it could establish a standard for future corporate handling of private customer data.