The investigation revealed that “since at least 2018,” Home Depot has been collecting customer email addresses during checkout to send them an electronic receipt. (Photo: Canadian Press)
OTTAWA. Canada’s Privacy Commissioner found that home goods store Home Depot shared electronic receipt data with Meta, the parent company of Facebook, without the knowledge or consent of customers.
In a report released Thursday, Commissioner Philippe Dufresne said the data provided by Home Depot included encrypted customer email addresses and information about their in-store purchases.
The Commissioner’s investigation found that the information shared with Meta was used to determine if the customer had a Facebook account. If so, Meta will compare what the customer bought from Home Depot to Facebook ads to see how effective they are.
Meta could also use customer information for its own business purposes, “including user profiling and ad targeting unrelated to Home Depot,” the commissioner found.
Thus, the investigation revealed that “since at least 2018,” Home Depot has been collecting customer email addresses during their checkout in order to send them an electronic receipt.
In a statement, Commissioner Dufresne says Home Depot customers are unlikely to expect their personal information to be shared with a third-party social media platform just because they opted for an electronic receipt at checkout.
“When customers were asked to provide their email address [à la caisse]They were never told that their information would be shared with Meta, and they were never given information about how Meta or Home Depot would use their information,” said Commissioner Dufresne. “This information would go a long way in helping customers decide whether or not to request an e-receipt.”
Mr Dufresne reminds businesses that they must obtain valid customer consent at the time of the sale before engaging in this type of business.
“Companies that increasingly seek to offer services online should pay particular attention to any use of the personal information they collect, as additional consent may be required,” Commissioner Dufresne explained.
“Silent agreement”
In its defense, Home Depot told the commissioner that it relied on “implied consent” and that its privacy statement, available on its website and printed on demand at retail outlets, adequately explained the company’s use of information. The retailer also referred to Facebook’s privacy policy.
The commissioner dismissed Home Depot’s arguments, saying the documents they relied on were not readily available at the checkout and there was no reason for customers to look for them.
“The explanations offered in the company’s policy were not enough to obtain a valid consent,” concludes Commissioner Dufresne.
He recommended that until Home Depot can take steps to secure valid consent, the retailer should stop disclosing to Meta the personal information of customers who request an electronic check at the checkout.
The commissioner indicates that Home Depot cooperated fully with the investigation, agreed to comply with the recommendations of the commissioner’s office. The commissioner added that Home Depot also stopped sharing customer information with Meta in October.
This post was produced with the financial support of Meta Exchanges and The Canadian Press for News.