It looks like the home improvement giant Home Depot Canada could use a little sprucing up.
According to reports from our neighbors to the north, Home Depot constantly shared customers’ data with meta, the parent company of Facebook and Instagram, without getting the appropriate consent, per an investigation by the federal privacy commissioner.
“It is unlikely that Home Depot customers would have expected that their personal information would be shared with a third-party social media platform simply because they opted for an electronic receipt,” commissioner Philippe Dufresne said in a press release on Thursday, Jan. 26.
Dufresne went into further detail at a press conference, calling it a violation of Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), a law aimed at protecting data privacy by placing rules on how organizations can collect, use, and share information. Basically, Home Depot Canada broke it.
“They did not obtain valid, meaningful consent,” said Dufresne, who warned other companies using similar practices that they need to stop. “This report is a reminder to all companies. … Our sense is this technique is…widely used.”
Per the Toronto Star, Dufresne said Home Depot used “consent fatigue” for not letting customers know at checkout that any email addresses they provided would be shared with Meta in accordance with Canada’s policy.
Home Depot’s emailed a statement to the outlet The Toronto Star was more buttoned up. In response to the commissioner’s findings, the juggernaut retailer said it only shared “non-essential information” via a Meta analytics tool. A rep from the retail giant also said the company stopped sharing this information when contacted by Dufresne’s office. Dufresne confirmed the business stopped sharing data with Meta in October 2022.
“We value and respect the privacy of our customers and are committed to the responsible collection and use of information,” the company said. “We’ll continue to work closely with the Office of the Privacy Commissioner of Canada.”
Meta declined to give a statement to the Star.
The privacy commissioner cannot fine Home Depot under Canadian law but can investigate further and recommend action. Currently, Canada’s legislatures are considering the Artificial Intelligence and Data Act, which would allow the federal privacy commissioner to fine businesses that breach the PIPEDA.
For now, experts suspect a class-action lawsuit against Meta and Home Depot Canada is likely.
Reddit is ready for it, too. In the r/technology subreddit, one person commented, “Everyone get ready for your 8-cent check from the class action suit.”
The snarkiness was palatable.
“How large will the fine be compared to the income? .000001%?” said another.
Others aren’t buying “consent fatigue.”
“What…is ‘consent fatigue?’ If you’re tired or if it’s too much to be asking for consent for the practice, you stop the practice, not the asking for consent part,” ranted another.
And then, the snarkiness continued.
“I wonder what they would have to say about ‘payment fatigue.’ You know, it gets really tiring to pay for all those items from shops,” someone wrote.
