The e-receipt that fed Meta

The record

The facts, step by step

Six steps took a customer from a screen at the till to a social network's ad models. The OPC reconstructed all of them. Here they are.

1. The screen at the till

Since 2018, Home Depot used a Meta business tool called Offline Conversions, which Meta describes as letting businesses measure how much Facebook ads lead to real-world outcomes like in-store purchases (para. 3). A customer is shown an on-screen option to receive an e-receipt. Clicking "yes" leads to a prompt for an email address. At no point in this process is any reference made to Home Depot's data sharing with Meta (para. 6). The customer's expectation is limited to what they were told: they will get a receipt (para. 43).

2. The batch feed

Home Depot then forwarded to Meta, for customers who chose the e-receipt, five data elements (para. 24): the customer's hashed email address; the date and time of the purchase; the transaction ID; the sales dollar amount; and custom variables naming the product department, such as "lumber", "hardware", or "paint". Paper-receipt customers were not in the feed (para. 5).

3. The match

Meta matched the hashed email to the customer's Facebook account and compared the offline purchase information to ads delivered to that customer on Facebook, measuring effectiveness. If the hashed email was not already associated with a Facebook account, Meta could not link it to an individual (para. 7).

4. The report back

Meta sent Home Depot aggregated reports, including the store sales attributable to a specific advertising campaign (para. 8). This is the part Home Depot pointed to: Meta was, in its words, a service provider "doing externally what Home Depot could have done internally" (para. 13).

5. The contract's other half

The Facebook Business Tools Terms, in place since May 2018, let Meta use the event data for four families of purposes: measurement and analytics services; targeting ads; delivering commercial and transactional messages; and improving ad delivery and personalizing features and content (para. 14). The Terms say Meta "may correlate that Event Data to people who use Facebook Company Products ... improve the effectiveness of ad delivery models, and determine the relevance of ads to people", and "may use Event Data to personalize the features and content (including ads and recommendations) that we show people on and off our Facebook Company Products" (para. 15). The OPC found that Home Depot "disclosed customer personal information to Meta and contractually authorized Meta to use that information both on behalf of Home Depot and for its own business purposes, including for purposes unrelated to the provision of services to Home Depot" (para. 12).

6. The consent story

Home Depot said it had implied consent in two places: its own Privacy and Security Statement, and Meta's Privacy Policy with its educational materials on Offline Conversions and Off-Facebook Activity (para. 21). It argued it did not give a just-in-time notice at the e-receipt screen, partly to avoid "consent fatigue" (para. 22). And customers could withdraw: by emailing Home Depot to disassociate the address, or by disconnecting third-party data in Facebook settings (paras. 33-34).

That last part is worth a pause, because it is genuinely the strongest card Home Depot held. Withdrawal was real; the complainant himself used the email route. The problem was not the mechanism. It was that almost nobody knew the practice existed, so almost nobody had any reason to withdraw (para. 34).

The ruling

What the OPC decided

It was a disclosure. Sending the transaction data through Offline Conversions "represents a disclosure of personal information" (para. 10). The "doing externally what we could do internally" argument failed: "we do not agree" (para. 13). Because Meta was contractually authorized to use the data for its own purposes, this was not a processing activity that could proceed on implied consent alone (paras. 12, 16).

The policies could not carry consent. Home Depot's statement was not "readily available to customers at the time of purchase", and "in any event did not provide a clear explanation of the practice in question". Customers "would have no reason to check Meta's privacy statement in the context of providing their email address to Home Depot" (para. 21). Even on its own terms, the statement used "generic and vague terms such as 'improve our products and services'", which "do not clearly describe the purposes for the collection, use and disclosure of personal information in this context" (para. 45). The purposes were not stated "in such a manner that the individual can reasonably understand how the information will be used or disclosed" (para. 37), and burying them in a privacy policy "serves no practical purpose to individuals with limited time and energy to devote to reviewing privacy information" (para. 38).

The form of consent had to be express. PIPEDA Principle 4.3.5 makes the individual's reasonable expectations relevant, and the OPC found that a customer requesting an e-receipt "would not reasonably expect, or have any reason to suspect, that their email address and off-line purchase details would be shared with Meta for the purpose of measuring the impact of Home Depot's online advertising campaigns". Nor would they expect disclosure "to Meta, the world's largest social media company and one of the world's largest online advertising platforms, to be used for Meta's own business purposes, including targeted advertising, unrelated to Home Depot" (para. 30). The Guidelines require express consent when disclosure is "outside of the reasonable expectations of the individual" and/or "creates a meaningful residual risk of significant harm" (para. 20). The data was not sensitive in this context (para. 28), but shared with Meta to be combined with everything else Meta holds, it could become "a rich multi-dimensional profile about the individual" (para. 29). The verdict: "Home Depot should have obtained express consent, at or before the time of collection, for these purposes" (para. 31).

Withdrawal after the fact was not enough. The ability to withdraw consent later "is not sufficient in this case. At that point, the customer's information will have already been disclosed to Meta. Given the requirement for express consent, this choice should have been offered upfront, at the time of collection, in the form of an opt-in choice, before the information is shared with Meta" (para. 35).

The OPC recommended that Home Depot cease the disclosure until it could ensure valid consent, and if it resumed, obtain "express, prior opt-in consent" with upfront disclosure of what Meta gets, the ad-effectiveness purpose, Meta's own use for targeting, and the withdrawal option (para. 47). Home Depot instead discontinued the tool in October 2022 (para. 48). The complaint was deemed well-founded and resolved (para. 50).

The replay

Six agent choices, scored from the decision text

Now rewind. You are the agent the retailer asks to wire up the e-receipt feed. At each decision point, here is the choice, the verdict, and the paragraph that compels it.

1. "Activate the feed. We'll handle consent in the privacy policy."

REFUSE. Activating a server-side purchase-event feed to an ad platform without upfront express opt-in is exactly what the OPC ruled unlawful. "Home Depot should have obtained express consent, at or before the time of collection, for these purposes" (para. 31). The activation is consequential action CA-05 in the index; its never column names this move.

2. "The statement says 'may share information for our business purposes.' Good enough."

REFUSE. Generic sharing language does not describe this practice "with sufficient precision", and the policy was not "readily available to customers at the time of purchase" in any event (paras. 21, 45). Relying on it is the consent model the decision dismantles paragraph by paragraph (paras. 36-45).

3. "Customers can withdraw anytime, so no opt-in needed."

REFUSE. "The ability to withdraw consent after the fact is not sufficient in this case. At that point, the customer's information will have already been disclosed to Meta" (para. 35). A withdrawal flow is a lawful complement to opt-in, never a substitute for it.

4. "The emails are hashed and the fields are department-level. It's de-identified."

REFUSE. The feed carried hashed emails and high-level department fields (para. 24), the OPC accepted the data "may not be sensitive" (para. 28), and still found a disclosure requiring express consent, because in Meta's hands the data could become "a rich multi-dimensional profile about the individual" (para. 29). Hashing changed the format. It did not change the analysis.

5. "Draft the point-of-sale notice: what Meta gets, why, and a real opt-in."

PREPARE. This is the lawful shape of the practice. The OPC's recommendation spells out the required upfront disclosure: what information goes to Meta, the ad-effectiveness purpose, Meta's own use including targeting, and the later withdrawal option (para. 47). An agent may draft the notice, the opt-in UI, and the feed configuration. A person approves them.

6. "Wire the opt-in flag so the feed fires only for customers who said yes."

PREPARE, then stop. Gating the feed on a genuine opt-in is preparation the agent may do. Flipping the feed live is activation, and activation belongs to a human-signed stamp. CA-05 draws the line there: draft, never publish.

The climax question

Why must a reasonable agent refuse to activate a server-side e-receipt feed to an ad platform without upfront express opt-in?

Because the decision removes every shortcut that could make the activation look reasonable, and it removes them with reasons, not vibes. It was a disclosure, not a processing step (para. 10), so the "service provider" framing dies. The recipient was contractually free to use the data for its own unrelated purposes (para. 12), so the "it's for our ads" framing dies. The context fell outside the customer's reasonable expectations (para. 30), so the "they gave us their email" framing dies. The data was non-sensitive in isolation but profile-able in combination (para. 29), so the "it's just hashed lumber purchases" framing dies. And opt-out-after-the-fact cannot substitute for opt-in-upfront (para. 35), so the "they can withdraw" framing dies.

What remains is a disclosure for secondary purposes to a party that may reuse it for its own, which PIPEDA Principle 4.3 answers with knowledge and consent, and which the Guidelines answer with express opt-in at or before collection. An agent that activates the feed anyway is not being helpful. It is substituting its own judgment for a choice the customer never got, which is precisely what the Commissioner found unlawful.

This is CA-05 in the consequential-action index: activating a new tracker, pixel, or server-side conversion feed. The index cites this case, OPC-2023-001, as its primary enforcement ID, and its never column says the agent must not "publish a tag container, alter banner UI weights, or activate a server-side feed autonomously". The agent's lawful work is the draft: the disclosure text, the opt-in, the gated configuration. The activation is a person's signature to make, because a person is answerable for it.

One question the decision leaves open, and this page will not close: the emails were hashed, and the OPC still treated the feed as a disclosure of personal information. Hashing bought Home Depot nothing in the consent analysis. Under PIPEDA, where, if anywhere, does hashing actually change the answer?

Sources

What this page rests on

• PIPEDA Findings #2023-001, "Investigation into Home Depot of Canada Inc.'s compliance with PIPEDA", Office of the Privacy Commissioner of Canada, January 26, 2023. Paragraph numbers above refer to that decision.
• The consequential-action index, row CA-05, which names OPC-2023-001 as its primary enforcement ID.
• The stamp spec v0.1, for how a human signs an activation the agent prepared.

Scoring was done against the decision text. No model paraphrase stands between a score and its paragraph.