The Home Depot, Inc. (NYSE: HD) is a Delaware-incorporated home-improvement retailer. Its Privacy and Security Statement (revised December 29, 2025) describes collection of identifiers, purchase history, internet activity including in-store Wi-Fi use, precise geolocation, in-store CCTV and audio, biometric facial recognition at select stores, and automatic license plate recognition data. It uses cookies, pixels, web beacons, and session replay software, and disclosures to advertising partners that it acknowledges may be a 'sale' or 'sharing' under state laws; its Orange Apron Media network monetizes first-party shopper data. Track record includes the 2014 payment-system breach (settled with 46 states for $17.5M in 2020) and a 2023 Canadian OPC finding of e-receipt sharing with Meta without consent. It offers opt-outs, honors Global Privacy Control, and publishes annual CCPA metrics.
TRACK RECORD
2 ENFORCEMENT ACTIONS
[2020-11-24]
On November 24, 2020, the Texas Attorney General announced that 46 states and the District of Columbia reached a $17.5 million settlement with The Home Depot resolving a multistate investigation of the 2014 breach, in which malware on self-checkout point-of-sale systems exposed payment card information of approximately 40 million consumers; the settlement requires a comprehensive information security program and a Chief Information Security Officer.
In a Form 8-K filed November 6, 2014, The Home Depot disclosed that, in addition to payment card data taken in the 2014 breach, separate files containing approximately 53 million email addresses were also taken; the same filing reported completion of enhanced payment-data encryption in all U.S. stores and an accelerated rollout of EMV chip-and-PIN technology.
The Home Depot's "Privacy & Security at a Glance" page lists collected information categories including video and audio recordings (in-store CCTV and customer care calls), biometric information including facial recognition, internet activity including in-store Wi-Fi use, property information such as home measurements and ownership, and inferences.
The Home Depot Privacy and Security Statement (last revised December 29, 2025) states that cameras and other technologies are used in stores, parking lots, and other facilities to learn about customer traffic and for security, and includes an ALPR Usage and Privacy Policy permitting collection of automatic license plate recognition data for fraud prevention, security, and asset protection.
The Home Depot publishes an annual California Privacy Rights & Report page disclosing CCPA request metrics; the calendar-year 2025 report itemizes access, deletion, correction, opt-out, and limit-use requests received and fulfilled (including 13,518,559 opt-out requests counting Global Privacy Control signals) and average days to fulfill each request type.
The Home Depot, Inc.'s Form 10-K for fiscal 2025 (filed with the SEC on March 18, 2026) states it is a Delaware corporation incorporated in 1978, headquartered in Atlanta, Georgia, with common stock listed on the New York Stock Exchange under ticker HD, reporting for itself and its consolidated subsidiaries.
In PIPEDA Findings #2023-001 (January 26, 2023), the Office of the Privacy Commissioner of Canada found that Home Depot of Canada shared customers' hashed email addresses and in-store purchase details with Meta through the Offline Conversions program without adequate consent; the complaint was ruled well-founded and resolved, and Home Depot discontinued use of the tool in October 2022.
The Home Depot Privacy and Security Statement (last revised December 29, 2025) acknowledges that its disclosure of identifiers, internet activity, commercial information, demographic information, location information, and inferences to advertising partners and joint marketing partners may be considered a "sale" or "sharing" under certain state laws; it provides a "Do Not Sell or Share My Personal Information" opt-out and recognizes the Global Privacy Control signal.
In an April 22, 2026 announcement, The Home Depot's retail media network Orange Apron Media said advertisers — including non-endemic brands not sold at The Home Depot — can activate campaigns on Pinterest, Reddit, The Trade Desk, and Yahoo powered by audience segments built from the company's first-party shopper data.
In a Form 8-K filed November 6, 2014, The Home Depot disclosed that, in addition to payment card data taken in the 2014 breach, separate files containing approximately 53 million email addresses were also taken; the same filing reported completion of enhanced payment-data encryption in all U.S. stores and an accelerated rollout of EMV chip-and-PIN technology.
On November 24, 2020, the Texas Attorney General announced that 46 states and the District of Columbia reached a $17.5 million settlement with The Home Depot resolving a multistate investigation of the 2014 breach, in which malware on self-checkout point-of-sale systems exposed payment card information of approximately 40 million consumers; the settlement requires a comprehensive information security program and a Chief Information Security Officer.
The Home Depot Privacy and Security Statement (last revised December 29, 2025) states the company collects information passively via browser cookies, pixel tags, and web beacons across its websites, applications, and emails, that partner third parties place similar tracking tools, and that session replay software may be used to record and replay users' interactions with its digital services.