Condita Research
← Back to catalogue/Federal (Canada)PIPEDA Findings #2023-001
Federal (Canada)Personal Information Protection and Electronic Documents ActWell-founded & resolved

PIPEDA Findings #2023-001: Investigation into Home Depot of Canada Inc.’s compliance with PIPEDA

Organization: Home Depot of Canada Inc.Complainant: Anonymous applicant
BookmarkView Governing Law
Plain-language brief

The complainant alleged that Home Depot disclosed his personal information to Meta (formerly Facebook) without his knowledge and consent. Home Depot was sending in-store customers' hashed email addresses and purchase details to Meta via an "Offline Conversions" tool when customers requested an e-receipt. This data allowed Meta to measure ad effectiveness and use the information for its own business purposes, including targeted advertising. The OPC found that Home Depot failed to obtain valid consent, as its privacy statement was not readily available or sufficiently clear, and customers would not reasonably expect such disclosure. Home Depot discontinued the use of the tool in October 2022 in response to OPC recommendations. The complaint was deemed well-founded and resolved.

Key issues
  1. 1Whether Home Depot obtained valid consent for disclosing customer personal information to Meta
  2. 2Whether the disclosure of personal information to Meta constituted a processing activity not requiring additional consent
  3. 3Whether Home Depot's Privacy Statement and Meta's Privacy Policy were sufficient to obtain meaningful implied consent
  4. 4Whether express opt-in consent was required for the disclosure of customer information to Meta
  5. 5Whether the information disclosed was sensitive
  6. 6Whether the disclosure was within the reasonable expectations of the individual
  7. 7Whether the ability to withdraw consent after the fact was sufficient
Outcome breakdownFavours: Applicant / complainant
  • Consent for disclosure: Invalid consent obtained
  • Privacy statement clarity: Statement not clear or available
  • Reasonable expectations: Disclosure not reasonably expected
  • Use of 'Offline Conversions' tool: Tool discontinued by institution
  • Complaint outcome: Complaint well-founded and resolved
Outcome

Complaint well-founded and resolved

Reasoning

Home Depot failed to obtain valid consent because its privacy disclosures were inadequate, the practice was outside customers' reasonable expectations, and express opt-in consent was required given the nature of the disclosure to Meta for its own business purposes. Home Depot resolved the issue by discontinuing the practice.

AI-generated summary for reference only. Always verify against the official decision ↗
Decision notes
Recommended action / remedy

Home Depot ceased disclosing customer personal information to Meta via the Offline Conversions Tool and committed to implementing measures to ensure valid express, prior opt-in consent and transparent privacy communications should it choose to re-engage with the tool.

Statutes considered
  • Principle 4.3 PIPEDA
  • Principle 4.3.4 PIPEDA
  • Principle 4.3.5 PIPEDA
  • Principle 4.3.2 PIPEDA
  • s.6.1 PIPEDA

This summary is informational only and not legal advice.

Pro · AI

Decisions with similar reasoning and facts — found by AI across statutes and jurisdictions, not just keywords.

Pro
Coverage — 13 of 14 jurisdictions searchable

Fully searchable: Ontario, British Columbia, Alberta, Saskatchewan, Newfoundland and Labrador, Northwest Territories, New Brunswick, Manitoba.

Partial (recent decisions only): Federal (Canada) (651 of 1,631), Nova Scotia (49 of 472), Quebec (6 of 7,090), Prince Edward Island (2 of 279), Yukon (1 of 75).

Coming soon: Nunavut — being re-processed for AI search.

Find decisions like this one — by meaning, not keywords.

Related by meaning is a Pro feature. Upgrade to surface conceptually similar decisions across the corpus, powered by AI.

Upgrade to Pro