Executive Summary: Key Legal and Evidentiary Issues

• Home Depot transferred customer email addresses and purchase data to Meta Platforms Inc., allegedly without obtaining proper customer consent, which the plaintiff claims violated provincial privacy statutes.

• The breach of contract claim was struck because the pleading lacked material facts supporting express or implied contractual terms regarding data protection.

• Certification of the privacy claim was upheld despite the contextual nature of privacy inquiries, as common issues existed in how data was collected, shared, and used.

• Non-Facebook users and corporations were properly included in the class definition, as the mere fact of transferring data to Meta is alleged to constitute the breach regardless of whether Meta matched the information.

• The "some basis in fact" threshold for certification was met through evidence of the respondent's uniform data collection and sharing practices across class members.

• Whether corporations can advance claims under the Privacy Act in British Columbia remains an open question appropriate for trial determination.

Background and the parties involved

Lasse Hvitved, a resident of British Columbia, purchased a shower head at a Home Depot store in Vancouver on July 11, 2021 and opted to receive an electronic receipt by providing his email address. The parties agree that from October 2018 to October 2022, Home Depot used an offline conversion tool offered by Meta Platforms Inc. and transferred information about in-store customer purchases to Meta. The respondent may have shared as many as 6.85 million unique hashed email addresses with Meta during this period.

The data sharing arrangement with Meta

Home Depot utilized Meta's "Offline Conversions" tool to assess whether its advertising campaigns on Facebook were leading to in-store sales. Through this arrangement, Home Depot transferred hashed (non-readable) strings of characters encoding customer email addresses, along with dates and times of purchases, purchase amounts, and the category of goods purchased such as "lumber", "hardware" or "paint". If a hashed email address matched one already held by Meta, the information could be linked to a specific Facebook account. Home Depot contends it understood that Meta would delete all the hashed email strings once the matching process was complete. Meta's contractual terms with Home Depot also allowed Meta to use the customer information for its own marketing purposes, including user profiling and targeted advertising unrelated to Home Depot.

The claims advanced and lower court proceedings

Hvitved sought to certify a class action advancing four claims: breach of privacy legislation, intrusion upon seclusion, unjust enrichment, and breach of contract. The Supreme Court of British Columbia, in its January 7, 2025 decision indexed at 2025 BCSC 18, struck three of these claims under the rules governing pleadings but certified the breach of privacy claim as a class action. The breach of privacy claim relies on privacy legislation in British Columbia, Saskatchewan, Manitoba, and Newfoundland and Labrador, which creates a tort actionable without proof of damage for a person to wilfully and without a claim of right violate the privacy of another.

The breach of contract claim fails

On appeal, Hvitved argued the judge erred in striking the breach of contract claim. The Court of Appeal disagreed, finding that the pleading contained barebone assertions without material facts supporting the existence of express or implied contractual terms governing data protection. The pleading failed to set out the nature of the contracts, whether they were oral or written, or even where one would find the express terms of the contract. The court noted that the appellant's Statement of Facts did not include any reference to an express term stipulating that his email address would be used solely for producing an electronic receipt, with this assertion appearing for the first time in Part 3 (Legal Basis) without factual grounding in Part 1.

Home Depot's cross appeal on certification

Home Depot cross-appealed the certification of the privacy claim, arguing that the individualized nature of privacy inquiries precluded class-wide resolution. The company contended that variations in class members' personal circumstances, subjective privacy expectations, and interactions with privacy statements made common issues impossible to identify. The Court of Appeal rejected this argument, relying on its previous decision in the Ari Liability Appeal, which established that the contextual inquiry required by s. 1(1) of the Privacy Act does not preclude a finding of commonality where there is some basis in fact for a common experience among class members.

The class definition stands

Home Depot also challenged the inclusion of non-Facebook users and corporations in the class definition. The Court of Appeal upheld the judge's decision, noting that on the face of its own pleadings and evidence, Home Depot admits sharing information about most, if not all, of the proposed class members with Meta. The alleged tortious conduct applies to both Facebook users and non-Facebook users, as the mere fact of a transfer, before any use by Meta, is said to constitute a breach. Regarding corporations, the court agreed with the chambers judge that whether a corporation can bring a claim under the Privacy Act in British Columbia is an open question and a matter best left for trial.

Ruling and outcome

The Court of Appeal for British Columbia, in a unanimous decision delivered by Madam Justice DeWitt-Van Oosten with Justices Gomery and Warren concurring, rendered judgment on February 3, 2026 dismissing both the appeal and the cross appeal. Neither party established reversible error. The class action certification for breach of privacy was upheld, allowing the case to proceed to trial on common issues including how Home Depot used the Meta offline conversions program, what personal information Home Depot provided to Meta, what steps Home Depot took to obtain consent from class members, and whether the disclosure constitutes a breach of privacy under applicable provincial statutes. No specific monetary award was determined at this appellate stage, as the matter will proceed to a trial on the merits.