According to an investigation from Canada’s chief privacy regulator, Home Depot routinely shared customers’ private data with Facebook without first obtaining their consent. The regulators believe this is a blatant violation of Canadian law, and hope to use the case as an example to other companies to be careful what data they share with platforms like Facebook.

The investigation found that Home Depot had been collecting customer email addresses at checkout in order to provide them with an electronic copy of their receipt. However, that information was then provided to Facebook parent company Meta, which used it to measure the effectiveness of targeted ads. For its part, Home Depot said it relies on “implied consent” for transactions like this, but privacy regulators said there would be no reason for customers to suspect their info was being transferred to Facebook.

“It is unlikely that Home Depot customers would have expected that their personal information would be shared with a third party social media platform simply because they opted for an electronic receipt,” Canadian federal privacy commissioner Philippe Dufresne said. “When customers were prompted to provide their email address, they were never informed that their information would be shared with Meta by Home Depot, or how it could be used by either company.”

As the regulators pointed out, this is likely a very common practice for both retail companies and Facebook. Hopefully this case encourages them to knock it off and do a better job protecting our data.

Recommended Resources

Choose what the experts use: award-winning cybersecurity you can trust and rely on.

Surf the web truly incognito. Try Bitdefender Premium VPN, the ultra-fast VPN that keeps your online identity and activities safe from hackers, ISPs and snoops.

System Mechanic 14 – Make your computer run like new. Winner of 200+ Editor’s Choice awards!