Hudson's Bay, Gap, PetSmart among stores that gave customer data to Facebook's owner

When a shopper shares their email address at the cash register — to receive an electronic receipt, rather than a paper one — do they really know where their details are being sent?

A CBC News review of Facebook user data suggests a variety of well-known retailers in Canada have been sharing customer information with the social media platform's parent company to gain marketing research in return. And it's not clear what steps have been taken to warn shoppers.

Purchases from department store giant Hudson's Bay, athletic apparel chain Lululemon, electronics retailer Best Buy, homeware store Bed, Bath & Beyond and beauty products chain Sephora all appeared in the Facebook data seen by CBC.

This is "a wake-up call" said Wendy Wong, a University of British Columbia political science professor who studies emerging technologies. "These revelations are showing the extent to which the public does not know how much of our activities are trackable."

Retailers that appeared in the Facebook data include:

Federal Privacy Commissioner Philippe Dufresne recently published a scathing report about the data-sharing practices of another major retailer, Home Depot. The report last month found the big-box retailer didn't seek proper consent from in-store customers as it systematically transmitted e-receipt details with Facebook's owner, Meta. 

Dufresne's investigation only focused on Home Depot, but the process appears widespread.

"We expect that this practice is used by other organizations," he said in an interview. "We found that this was in breach of privacy law and that this practice has to stop."

Hudson's Bay said in light of the privacy commissioner's findings about Home Depot, the department store chain has "suspended all data transfers to Meta."

Hudson's Bay spokesperson Tiffany Bourré told CBC the company is reviewing its data-sharing practices.

The privacy commissioner said Home Depot customers' encoded email addresses and purchase information were handed over. Meta then used the data to analyze how online ads lead to purchases in brick-and-mortar stores.

Dufresne's report raised concerns that in certain stores, purchase details could prove "highly sensitive … where they reveal, for example, information about an individual's health or sexuality."

WATCH | Home Depot called out for sharing customers' data without proper consent:

The privacy watchdog's report stemmed from a complaint filed by a man who was deleting his Facebook account, only to discover the platform had a list of in-store purchases he'd made at Home Depot.