When a shopper shares their email address at the cash register — to receive an electronic receipt, rather than a paper one — do they really know where their details are being sent?
A CBC News review of Facebook user data suggests a variety of well-known retailers in Canada have been sharing customer information with the social media platform's parent company to gain marketing research in return. And it's not clear what steps have been taken to warn shoppers.
Purchases from department store giant Hudson's Bay, athletic apparel chain Lululemon, electronics retailer Best Buy, homeware store Bed, Bath & Beyond and beauty products chain Sephora all appeared in the Facebook data seen by CBC.
This is "a wake-up call" said Wendy Wong, a University of British Columbia political science professor who studies emerging technologies. "These revelations are showing the extent to which the public does not know how much of our activities are trackable."
Retailers that appeared in the Facebook data include:
- Anthropologie.
- Bed, Bath & Beyond.
- Best Buy.
- Gap.
- Hudson's Bay.
- Lululemon.
- PetSmart.
- Sephora.
Federal Privacy Commissioner Philippe Dufresne recently published a scathing report about the data-sharing practices of another major retailer, Home Depot. The report last month found the big-box retailer didn't seek proper consent from in-store customers as it systematically transmitted e-receipt details with Facebook's owner, Meta.
Dufresne's investigation only focused on Home Depot, but the process appears widespread.
"We expect that this practice is used by other organizations," he said in an interview. "We found that this was in breach of privacy law and that this practice has to stop."
Hudson's Bay said in light of the privacy commissioner's findings about Home Depot, the department store chain has "suspended all data transfers to Meta."
Hudson's Bay spokesperson Tiffany Bourré told CBC the company is reviewing its data-sharing practices.
The privacy commissioner said Home Depot customers' encoded email addresses and purchase information were handed over. Meta then used the data to analyze how online ads lead to purchases in brick-and-mortar stores.
Dufresne's report raised concerns that in certain stores, purchase details could prove "highly sensitive … where they reveal, for example, information about an individual's health or sexuality."
WATCH | Home Depot called out for sharing customers' data without proper consent:
Home Depot shared customers’ personal data with Meta without their consent, Canada’s privacy watchdog says. Its investigation found that the retail giant was sharing e-receipt data, including email addresses, with Facebook’s parent company.
Facebook user data reviewed
The privacy watchdog's report stemmed from a complaint filed by a man who was deleting his Facebook account, only to discover the platform had a list of in-store purchases he'd made at Home Depot.
A group of CBC journalists each downloaded their personal data from the social media company — information known as "off-Facebok activity" — and found retail purchases listed from multiple chains. (Facebook tells users how to request their own files here.)
Facebook data showing purchases from PetSmart, for instance, aligned with e-receipts received in recent months for in-store purchases.
A PetSmart spokesperson declined to say how much personal customer data the chain shares with Meta, and how it warns shoppers about its data-sharing practices when they're asked for their email address.
"We continuously review our data-sharing practices," the company said in a statement.
PetSmart's privacy policy states: "We may share the information we collect with companies that provide support services to us."
The privacy commissioner said Home Depot's privacy statement didn't constitute consent "for its disclosure to Meta of the personal information of in-store customers requesting an e-receipt."
Other retailers with purchases listed in the downloaded Facebook data include fashion chains Anthropologie and Gap, which also owns brands Banana Republic, Old Navy and Athleta.
CBC reached out to each retailer and provided purchase data downloaded from Facebook. Gap declined to comment. The other companies did not respond.
"For the average person, it might feel invasive," said Opeyemi Akanbi, an assistant professor at Toronto Metropolitan University's school of professional communication. But from a business's perspective, "data is very precious… to get a better sense of what people are doing and to target advertising more effectively."
Companies, however, "must generally obtain an individual's consent when they collect, use or disclose that individual's personal information" under Canadian law, according to the Office of the Privacy Commissioner.
"The risk is that we trivialize the use of personal information," Dufresne said. "Treat privacy as a priority. It's a fundamental right."
In reality, businesses face little risk. The privacy commissioner does not have the authority to levy fines. He can only issue recommendations.
Class action launched
Regina-based lawyer Tony Merchant launched a national class action against Home Depot in light of the privacy watchdog's findings. The lawsuit has not yet been certified.
Facebook compiles massive amounts of data about individuals and "ends up with a total profile of when you're having a baby, when you'll need a mortgage ... all these kinds of things are exceptionally intrusive," Merchant said.
Home Depot said it stopped using Meta's offline conversions tool last October, after the privacy watchdog approached the company.
The program is designed to gauge the effectiveness of ads on Meta's platforms and how they "lead to real-world outcomes," such as in-store purchases, according to the Silicon Valley firm. Meta declined to say how many retailers in Canada provide data about their customers.
Facebook users may request the platform stop logging their interactions with some or all businesses. Instructions are listed here.
"It's important we become more aware of the datafication of our lives," Wong, the UBC professor, said, referring to the way personal information is increasingly treated as a commodity.
"It's happening regardless of whether we're aware of it or not."
WATCH | Retailers gave customer data to Meta:A CBC News investigation has found the practice of selling customer data to Facebook’s parent company, Meta, without their consent is more widespread than previously thought. The list of Canadian retailers doing so includes Lululemon, Hudson's Bay and Best Buy.