BC court approves privacy class action over Home Depot receipts

A British Columbia Supreme Court judge says a class-action lawsuit alleging Home Depot violated its customers’ privacy when it collected and shared their information after purchase receipts were emailed.

The lawsuit alleges that Home Depot collected information when BC customers selected emailed receipts, including the purchase price, purchased brands and data related to the customer’s email address, and then shared it without consent with tech giant Meta.

Judge Peter Edelmann allowed class certification of the alleged privacy violations in a ruling posted online Wednesday, but he rejected claims that Home Depot breached other duties and contractual obligations.

The certification is not a finding of wrongdoing, and Home Depot did not immediately respond to a request for comment.

The decision says Meta, which runs Facebook, offered a service that helps the company understand whether its advertising campaigns on the social media platform led to in-store sales.

The court document says Home Depot argued that customers had no reasonable expectation of privacy because the information shared with Meta was “high level” and less sensitive, but Edelmann disagreed, saying privacy expectations “cannot assessed on a piecemeal basis.”

The ruling says the claim involves more than six million emails and corresponding data shared with Meta over several years. The judge said the alternative to a class action would be hundreds of thousands of individual claims “that are simply not viable.”

“The value of the individual claims will also make the cost of litigation prohibitive, as individual claimants are unlikely to recover the actual costs,” he said.

SEE | Canada’s privacy watchdog says customer data was shared without consent:

Home Depot shared customer data without consent: privacy watchdog

Home Depot shared customers’ personal data with Meta without their consent, Canada’s privacy watchdog says. Its investigation found that the retail giant shared e-receipt data, including email addresses, with Facebook’s parent company.

“The plea, as I understand it, is that Home Depot’s customers had a reasonable expectation that their purchase data would not be collected and shared with Meta to be used to generate marketing information not only for Home Depot, but also for Meta’s own marketing purposes, including user profiling and targeted advertising unrelated to Home Depot.”

The decision says other class actions with similar allegations have also been launched in Quebec and Saskatchewan.

It follows a 2023 report by Canada’s privacy watchdog, which found the retailer shared customer data with Meta without consent.

Commissioner Philippe Dufresne released the report, saying Home Depot began sharing details from electronic receipts with Meta in 2018 — including encrypted email addresses and in-store purchase information — without customers’ knowledge or consent. The company said it stopped sharing customer information with Meta in October 2022.

According to the privacy report, information sent to Meta was used to determine whether a customer had a Facebook account. If they did, Meta compared the person’s in-store purchases to Home Depot’s ads to measure their effectiveness.

Home Depot told Dufresne’s office that it relied on implied consent and that its privacy statement — available through its website and print-on-demand at retail locations — explained that the company uses de-identified information for internal business purposes.