The British Columbia Supreme Court on Tuesday upheld a class action lawsuit accusing Home Depot of polling customers’ emails to send an electronic receipt and then sharing that email list with third parties.

The third party in question was Facebook’s parent company Meta. The customers argued in their submissions that Home Depot gained unfair financial advantages by violating privacy regulations and contractual obligations to store visitors.

It all started in 2018 when Home Depot asked customers to enter their email addresses to receive an electronic receipt for their purchase. In addition to emailing the receipt, Home Depot also retained customers’ emails to create a profile that tracked their purchases.

Home Depot apparently provided the list of emails to Meta to use a Meta program that allowed a company to track the success of its Facebook advertising campaigns. The company could apparently see how many customers saw a Facebook ad for a particular product and made the actual purchase — if the email they gave Home Depot was also linked to their Facebook account.

The goal of the program was to give companies insight into how many customers made offline purchases that were similar to the online ads they saw on Facebook.

“Based on Meta’s representations, Home Depot says it understood that Meta would delete all hashed email strings once the matching process was complete,” says the British Columbia Supreme Court’s certification of the class action lawsuit.

It is estimated that Home Depot shared nearly 7 million customer emails with Meta between 2018 and 2022.

The issue was also the subject of an Ontario Privacy Commissioner (OPC) investigation that began in 2021. In a 2023 press release about the case, the OPC said the complainant attempted to delete his Facebook account when he learned that the social media company had a record of most of his Home Depot purchases. The OPC said that neither Meta nor Home Depot sought customers’ consent to share this information. Home Depot discontinued the practice in 2022 following the OPC’s recommendation.

But Merchant Law Group believes its clients deserve more than Home Depot changing its practices. The company is pursuing the Canada-wide class action lawsuit, which is open to anyone who shopped at a physical Home Depot store between May 1, 2018 and October 31, 2022 and provided their email address.

The BC Supreme Court agreed to certify the case on January 7. Certification allows the case to move through the next steps of the legal process and be heard in court.

“In today’s business landscape, personal information about large numbers of individuals is used and deployed, each of whom may have limited ability to assert or protect their rights,” the judge wrote. “I am confident that a class proceeding is the preferable procedure in this case and provides a fair, efficient and manageable method of identifying the common issues and advancing the claim.”

Daily Hive has reached out to Home Depot for comment.