Home Depot, Inc. (The)

Home Depot's data privacy record begins with one of the largest retail breaches in history. From April to September 2014 attackers used credentials stolen from a third-party vendor to deploy custom malware on self-checkout systems across 2,200 stores, exposing 56 million payment cards over five months. The breach cost Home Depot $179 million in settlements: $134.5 million to banks and credit card companies, $27 million to additional financial institutions, and $17.5 million to a multistate coalition of 46 attorneys general.

Home Depot's Orange Apron Media network (formerly Retail Media+) provides advertisers access to behavioral and purchase data from 198 million individual customers, enabling retargeted advertising across social media and offsite channels. In January 2023, the Office of the Privacy Commissioner of Canada found that Home Depot had been sharing customer email addresses and in-store purchase information with Meta through Meta's Offline Conversions program from 2018 through October 2022, without customer knowledge or consent. The Commissioner rejected Home Depot's argument that its privacy statements constituted adequate consent. In 2024 a class action filed under the California Invasion of Privacy Act alleged that Home Depot allowed Google's Cloud Contact Center AI to monitor and record customer service calls without consent. A separate 2023 class action alleged the company embedded session-replay software on its website to intercept users' browsing activity.

Home Depot also deploys Flock Safety automated license-plate readers in its parking lots and stores. Although the company states it does not grant direct access to federal law enforcement, reporting by 404 Media documented that ICE agents have used Flock Safety data for immigration enforcement investigations after local police departments forwarded the data — creating what the Interfaith Center on Corporate Responsibility described in a letter to Home Depot's board as "de facto federal surveillance without transparency or consent." Home Depot stores have become frequent sites for ICE arrests targeting migrant day laborers who congregate in parking lots. In January 2026, Zevin Asset Management led a shareholder proposal with 17 co-filers asking Home Depot to evaluate and report the privacy and civil rights risks associated with sharing data with third-party surveillance vendors, including the risk of "discrimination or wrongful detention from misuse of customer data." Home Depot's own privacy policy discloses that it shares demographic information including age, race, ethnicity, and gender with "law enforcement, public and government authorities."