The Bay, Gap and PetSmart are among the stores that have passed data from their Canadian customers to Meta, Facebook's parent company, often without their knowledge.
Retailers tell Meta what their customers are buying when they request their receipt by email.
When you choose in store to receive your receipt by email, rather than in a printed version, do you really know who has access to your information?
Facebook user data collected by CBC/Radio-Canada reveal that several well-known retailers in the country have transmitted information about their customers to Meta, the parent company of the social network. And it's not clear whether consumers were warned about it.
Shopping at Hudson's Bay, Gap, Lululemon, Best Buy, Sephora, Anthropologie, PetSmart and Bed, Bath & Beyond, among others, were listed in the Facebook data we analyzed.
This is a red flag, says Wendy Wong, a professor in the Department of political science from the University of British Columbia, which focuses on emerging technologies and privacy.
“These revelations show us how little the public knows how much of our activity is traceable.
—Wendy Wong, Emerging Technology Specialist, University of British Columbia
Last month, home improvement store Home Depot was singled out by the Commissioner of Privacy Canada for providing Facebook with private information from its customers who preferred to obtain their receipt by email.
In his scathing report, Commissioner Philippe Dufresne revealed that the hardware store had been systematically sending details of electronic receipts to Meta, without informing customers and without obtaining their consent, for at least four years.
This information allows Meta to tailor its advertisements as part of its offline conversions program, which relies in particular on in-store purchases and telephone reservations.
The report stated that purchase details can be of a very sensitive nature when they reveal, for example, information about consumers' health, sexuality or finances.
C& #x27;was maybe not always sensitive, if you buy wood or hardware, but for other stores, other types of purchases, it is very intimate, affirmed Philippe Dufresne interviewed by Radio-Canada.
The Privacy Commissioner of Canada, Philippe Dufresne, presented his latest report to the press on January 26th.
Although the commissioner's investigation focused only on Home Depot, this practice could be much more widespread, according to him.
Companies need to be clear with customers, explaining what they want to do with the information and who they want to share it with and why, says Dufresne.
“Customers cannot be assumed to consent to this simply because they choose an e-receipt.
—Philippe Dufresne, Privacy Commissioner of Canada
The Hudson's Bay Company says it has suspended all data transfers to Meta since this report was published. Its spokesperson Tiffany Bourré adds that the company is currently reviewing its data communication practices.
The Privacy Commissioner's investigation stems from a complaint by a consumer who, upon deleting his Facebook account, discovered that the platform had a list of his Home Depot purchases. It was when the company denied having passed on his information to the social network that the man decided to file a complaint.
Twenty CBC/Radio-Canada journalists downloaded their personal data on their activity outside of Facebook, following the approach offered by the social network for the sake of transparency.
It lists our purchases in several major chains. This data shows, for example, the details of purchases made in recent months in PetSmart stores and which correspond to electronic receipts.
PetSmart is one of the companies that provide Meta, Facebook's parent company, with details about their customers' purchases.
The pet products company says it constantly reviews its data-sharing practices, but declines to elaborate on how much personal data it shared with Meta and how it notifies customers when emailing receipts.
The Privacy Commissioner has said, however, that such a statement, similar to Home Depot's, does not constitute consent for the disclosure of personal information with Meta.
Other retailers whose purchases are listed in the analyzed Facebook data include fashion chains Anthropologie and Gap, which also owns brands Banana Republic, Old Navy and Athleta.
CBC/Radio-Canada contacted each retailer and provided them with purchase data downloaded from Facebook. Gap declined to comment on the case, while the other companies did not respond to our requests.
For the average consumer, it may seem intrusive, says Opeyemi Akanbi , Assistant Professor in the School of Professional Communication at Metropolitan University of Toronto. But for companies, this data is invaluable […] to get a better idea of what people are doing and to better target advertising.
Opeyemi Akanbi, Assistant Professor, School of Professional Communication, Metropolitan University of Toronto
However, under Canadian law, companies are usually required to obtain consent from individuals when collecting, using or disclosing personal information about them.
Risk, c is the trivialization of privacy or the protection of personal information. It is absolutely necessary to fight against this, says Commissioner Philippe Dufresne.
It is a fundamental right.
In Canada, however, businesses face little risk. The Office of the Privacy Commissioner does not have the power to impose fines. It can only make recommendations.
There could soon be a price to pay for companies that poorly protect their customers' private information: Bill C-27, in the House of Commons, including penalties of up to $25 million, or 5% of worldwide revenue, whichever is greater.
Home Depot, for its part, says it stopped using Meta's offline conversions tool last October after being approached by the Office of the Privacy Commissioner.
< p class="e-p">Facebook's parent company declined to say how many Canadian retailers provide it with customer data. Social network users can ask the platform to stop recording their interactions in-store and elsewhere on the web.
It is important to be aware of the data of our lives, says Wendy Wong of the University of British Columbia. This phrase refers to the monetization and commodification of our personal data.
This happens whether we are aware of it or not.
With information from CBC's Thomas Daigle and Megan McCleister