Canadian privacy & access decisions

The complainant alleged that Home Depot disclosed his personal information to Meta (formerly Facebook) without his knowledge and consent. Home Depot was sending in-store customers' hashed email addresses and purchase details to Meta via an "Offline Conversions" tool when customers requested an e-receipt. This data allowed Meta to measure ad effectiveness and use the information for its own business purposes, including targeted advertising. The OPC found that Home Depot failed to obtain valid consent, as its privacy statement was not readily available or sufficiently clear, and customers would not reasonably expect such disclosure. Home Depot discontinued the use of the tool in October 2022 in response to OPC recommendations. The complaint was deemed well-founded and resolved.

• Whether Home Depot obtained valid consent for disclosing customer personal information to Meta
• Whether the disclosure of personal information to Meta constituted a processing activity not requiring additional consent
• Whether Home Depot's Privacy Statement and Meta's Privacy Policy were sufficient to obtain meaningful implied consent
• Whether express opt-in consent was required for the disclosure of customer information to Meta
• Whether the information disclosed was sensitive
• Whether the disclosure was within the reasonable expectations of the individual
• Whether the ability to withdraw consent after the fact was sufficient