Home Depot of Canada broke the law
when it shared encoded email addresses and other customer data with
Facebook owner Meta without consent, Canada's privacy regulator found.
Home Depot shared customers' electronic receipts with the social media giant through Meta's offline conversions program.
- The
data — which included customers' email addresses and in-store purchase
information — was sent to Meta to determine if the customer had a
Facebook account.
- If so, Meta compared the customers' purchased
items to ads they had seen on the platform in order to measure their
effectiveness.
- Meta also used the data for targeted advertising
and other purposes not related to Home Depot, Canada's privacy
commissioner found.
- In a report released this week,
Commissioner Philippe Dufresne said Home Depot violated Canada's federal
Personal Information Protection and Electronic Documents Act (PIPEDA) by providing the data to Meta without customer consent.
- While Home Depot has since halted the program, he warned that other organizations may be doing the same thing.
- “This practice is not consistent with privacy law and has to stop,” Dufresne said.