A British Columbia Supreme Court judge says a class-action lawsuit alleging Home Depot violated its customers’ privacy when collecting and sharing their information after emailing purchase receipts can proceed.
The lawsuit alleges Home Depot gathered information when B.C. customers opted for emailed receipts, including the purchase price, brands bought, and data related to the customer’s email address, then shared it without consent with technology giant Meta.
Justice Peter Edelmann allowed the certification of the class for the alleged breaches of privacy in a decision posted online Wednesday, but he dismissed claims that Home Depot violated other duties and contractual obligations.
The certification is not a finding of wrongdoing, and Home Depot did not immediately respond to a request for comment.
The decision says Meta, which operates Facebook, offered a service to help the company understand if its advertising campaigns on the social media platform were leading to in-store sales.
The court document says Home Depot argued customers had no reasonable expectation of privacy because the information shared with Meta was “high-level” and less sensitive, but Edelmann disagreed, saying that privacy expectations “cannot be assessed on a piecemeal basis.”
The decision says the claim involves more than six million emails and corresponding data shared with Meta over several years. The judge said the alternative to a class-action lawsuit would be hundreds of thousands of individual claims “which are simply not feasible.”
“The value of the individual claims would also make the costs of litigation prohibitive as individual claimants would be unlikely to recover the actual cost,” he said.
Home Depot shared customers’ personal data with Meta without their consent, Canada’s privacy watchdog says. Its investigation found that the retail giant was sharing e-receipt data, including email addresses, with Facebook’s parent company.
“The pleading, as I understand it, is that Home Depot’s customers had a reasonable expectation that their purchase data would not be compiled and shared with Meta to be used not only to generate marketing information for Home Depot but also for Meta’s own marketing purposes, including user profiling and targeted advertising unrelated to Home Depot.”
The decision says other class-action proceedings making similar allegations have also been launched in Quebec and Saskatchewan.
It follows a 2023 report from Canada’s privacy watchdog, which found that the retailer shared customer data with Meta without consent.
Commissioner Philippe Dufresne released the report saying Home Depot began sharing details from electronic receipts with Meta in 2018 — including encoded email addresses and in-store purchase information — without the knowledge or consent of customers. The company said it stopped sharing customer information with Meta in October 2022.
According to the privacy report, information sent to Meta was used to determine whether a customer had a Facebook account. If they did, Meta compared the person’s in-store purchases to Home Depot’s ads to gauge their effectiveness.
Home Depot told Dufresne’s office that it relied on implied consent and that its privacy statement — accessible through its website and print-upon-request at retail locations — explained that the company uses de-identified information for internal business purposes.
