PIPEDA Findings #2023-001: Investigation into Home Depot of Canada Inc.’s compliance with PIPEDA
The Office of the Privacy Commissioner of Canada investigated Home Depot for disclosing customer email addresses and purchase details to Meta (Facebook) through Meta's "Offline Conversions" tool without valid consent. Home Depot used this tool to measure the effectiveness of its Facebook ads. The OPC found that Home Depot's privacy statement and Meta's policy were insufficient to obtain implied consent for this disclosure, as customers were not reasonably expected to understand that their data would be shared for these secondary purposes. Home Depot has since discontinued the use of the tool and agreed to implement recommendations for obtaining express consent should they restart the practice.
- Whether Home Depot obtained valid consent for disclosing customer purchase data to Meta.
- Whether the information disclosed was sensitive.
- Whether Home Depot's privacy statement and Meta's policies provided sufficient notice and clarity.
- Whether express opt-in consent should have been obtained.
Complaint well-founded and resolved.
The OPC found that Home Depot failed to obtain valid consent because customers requesting e-receipts would not reasonably expect their purchase information to be disclosed to Meta for advertising measurement and Meta's own purposes. Home Depot subsequently discontinued the practice.
AI-generated summary for reference only. Always verify against the official decision ↗
Home Depot discontinued the use of Meta's Offline Conversions Tool and committed to implementing measures for obtaining express consent should they restart the practice.
- Principle 4.3 PIPEDA
- Principle 4.3.4 PIPEDA
- Principle 4.3.5 PIPEDA
- Section 6.1 PIPEDA
- Principle 4.3.2 PIPEDA
This summary is for informational purposes only and does not constitute legal advice.