Executive Summary: Key Legal and Evidentiary Issues

• Scope of valid consent for communicating customers’ personal information (hashed emails and purchase data) by Home Depot to Meta/Facebook and whether this infringes the Charter right to privacy
• Legal sufficiency of alleged “economic loss” based on the commercial value of customers’ personal data to support compensatory damages in a privacy-based class action
• Distinction between in-store and online customers, and whether Home Depot’s online privacy declaration adequately discloses third-party advertising uses or instead supports an inference of intentional, unlawful privacy infringement
• Application and reach of the Competition Act’s false or misleading representation provisions (s. 52(1)) to Home Depot’s statements around receipt emails and use of data, including whether the address email use is “material”
• Procedural threshold for authorizing a Québec class action under article 575 C.p.c., particularly how far a motion judge may go in weighing evidence and legal theories at the screening stage
• Proper description of the class, including whether persons without Facebook accounts—whose hashed emails could not be linked to a Facebook identity—should be included in the group definition

Facts of the case

Option Consommateurs brought a proposed class action against Home Depot of Canada Inc. in Québec, arising from Home Depot’s practice of transmitting customer data to Meta Platforms Inc. (Facebook) without what regulators and the plaintiff alleged to be valid consent. In stores, customers could choose on the payment terminal to receive an electronic receipt. If they selected “Yes”, they were prompted to enter their email address. They were not told at the point of sale that their information would be shared with Meta, nor guided to any privacy policy of either Home Depot or Meta. For online purchases, customers similarly had to provide an email address to receive a receipt. Unlike the in-store experience, each page of Home Depot’s website contained a link to its “Déclaration sur la sécurité et la confidentialité”, and at checkout there was a reference to acceptance of “conditions d’utilisation” that incorporated this privacy declaration. That declaration described the types of information collected (including purchase history and email addresses), the circumstances of collection (including in-store and online purchases), and stated that such information could be used for business purposes such as improving products and services, examining customer trends and interests, and using de-identified data for internal commercial purposes. It also indicated that Home Depot could share personal information “à des fins professionnelles” with third parties providing services on its behalf.

In both in-store and online channels, Home Depot used Meta’s “Conversions hors ligne” advertising tool. To do so, it transmitted a hashed version of customers’ email addresses to Meta, along with transaction details such as the date and time of purchase, transaction identifier, sale amount, and product category information. If a hashed email matched an existing Facebook account, Meta could link the transaction to a particular Facebook user. Meta then compared offline purchases to Facebook ad impressions to measure the effectiveness of advertising campaigns and reported aggregated results to Home Depot. Meta could also, according to the case record, use this data for its own commercial purposes, including targeted advertising unrelated to Home Depot, based on its own user agreements. For individuals who did not have a Facebook account, Meta could not match the hashed email to a specific person, so no identified personal data flowed through the system in a way Meta could tie to that individual.

The Canadian Office of the Privacy Commissioner investigated Home Depot’s practices and in January 2023 issued a report concluding that Home Depot had failed to obtain valid and meaningful consent from customers for the transmission of their information to Meta for Meta’s purposes. By that time, Home Depot had stopped using the Conversions hors ligne tool and agreed to implement the Commissioner’s recommendations, leading to the complaint being found “founded and resolved”. The day after the report’s publication, Option Consommateurs filed its application for authorization to institute a class action and later amended it to add online customers to the proposed group.

Claims advanced and legal framework

The plaintiff’s amended authorization application alleged that Home Depot had extracted customers’ email addresses on the pretext of sending electronic receipts, then communicated these emails and related purchase data to Meta in breach of customers’ right to privacy under section 5 of the Québec Charter of human rights and freedoms. The primary theory of loss was an economic one: class members were said to be entitled to “a sum equal to the value of the personal information communicated to third parties for commercial purposes without their consent”. The pleadings did not claim moral damages; there were no allegations of inconvenience, harassment, or emotional distress flowing from the sharing of data.

On the merits side (as framed at this preliminary stage), the claim relied on multiple legal bases: the Civil Code of Québec (including article 1611 on the assessment of damages), the Québec Charter (particularly section 49 on punitive damages for intentional and unlawful violations of Charter rights), the consumer protection statute (Loi sur la protection du consommateur, or L.p.c.), and the federal Competition Act (Loi sur la concurrence, L.c.). Under the Competition Act theory, the plaintiff alleged that Home Depot’s representations about email collection and the use of the data were false or misleading in a material respect, contrary to section 52(1). On this basis it sought recovery under section 36 for both the loss caused and “an additional amount” not exceeding the full costs of investigation and proceedings, including lawyers’ fees and disbursements. Procedurally, the case turned on the Québec Code of Civil Procedure’s class action authorization test in article 575 C.p.c., especially the low-threshold requirement that “the facts alleged appear to justify the conclusions sought” and the limited screening “filter” role of the motions judge.

The relief requested at authorization foreshadowed the intended scope of the eventual merits claim: collective recovery of an amount equal to the value of the personal data transmitted to Meta; CAD 10 million in punitive damages; legal and expert costs as a collective recovery; interest and the additional indemnity; and orders structuring individual liquidation of claims or, failing that, a cy-près style distribution for collective benefit. None of these amounts were decided at the authorization stage; they remained requested outcomes contingent on later proof and substantive findings.

Decision of the Superior Court

The Superior Court of Québec partly granted and partly refused the authorization. It authorized a class proceeding only with respect to punitive damages under the Québec Charter for privacy violations, and only for a narrowed group. The authorized class was limited to persons with Facebook accounts who purchased or rented goods or services in a Québec Home Depot store (not online) and who provided an email address between January 1, 2018 and October 30, 2022. The judge declined to authorize the action for compensatory damages, finding that the alleged economic loss—framed as the “value” of personal data—was not adequately demonstrated at law. Relying on earlier case law arising from data breaches and loss of devices rather than commercial exploitation, the judge concluded that the mere fact that personal information ends up in the possession of a third party, without more, is not recognized as compensable economic damage.

The Superior Court also found that the allegations did not support an intentional and unlawful violation of privacy for online purchasers. The judge treated Home Depot’s online privacy declaration and contractual notices as evidence of an effort to obtain consent, not an intentional breach, and thus refused to include online customers in the group for punitive damages. In addition, the judge held that the L.p.c. did not apply to the impugned representations and that the Competition Act cause of action was not defensible. Finally, the authorized group definition was framed to exclude individuals without Facebook accounts, on the basis that Meta could not link a hashed email to an identified person if that person did not have a Facebook account, and therefore no personal information about them was effectively disclosed in an identifiable form.

Option Consommateurs appealed, challenging the refusal to authorize compensatory damages, the exclusion of online customers, the rejection of the L.p.c. and Competition Act theories, and the exclusion of people without Facebook accounts.

Court of Appeal’s analysis on compensatory damages

The Court of Appeal held that the authorization judge had gone too far in rejecting the possibility of compensatory damages at the screening stage. It emphasized that under Québec’s class action regime the bar is intentionally low: the applicant need only show a simple possibility of success, not a realistic or reasonable likelihood grounded in extensive factual proof. The focus is whether the facts alleged, combined with at least one viable legal foundation, appear to justify the conclusions sought.

In examining the plaintiff’s economic-loss theory, the Court considered the Supreme Court of Canada’s obiter in Aubry v. Éditions Vice-Versa on the potential patrimonial value of a person’s image and the possibility of compensating such value through damages based on lost gains or foregone profits. While acknowledging that the pleadings contained few specific allegations about the monetary worth of the data to the class members themselves, and that Home Depot’s arrangement with Facebook appeared not to involve direct monetary payment for the data, the Court found it at least arguable that the personal information communicated had some commercial value, at minimum to Meta. It noted that Meta’s offline conversions tool enabled Home Depot to measure advertising effectiveness and that Meta could use the data to build “lookalike” audiences, indicating an economic dimension to the information. Against that backdrop, the Court held that positing a compensable economic loss tied to the unauthorized commercial use of personal data was not frivolous or manifestly ill-founded.

The Court contrasted the Superior Court’s reliance on cases like Li v. Equifax and Sofio v. OCRCVM, which involved data breaches or loss of devices without commercial exploitation. Those cases dealt primarily with moral injury (stress, inconvenience) or the risk of future misuse rather than the sale or business leveraging of data. Given this important factual distinction, the earlier authorities did not foreclose the plaintiff’s theory in the present commercial-use context. The Court concluded that the rejection of compensatory damages at authorization was premature and that issues and conclusions related to compensatory damages had to be restored so they could be decided at the merits stage.

Court of Appeal’s analysis on online customers and intent

With respect to online customers, the Court of Appeal found a legal error in the Superior Court’s approach. The motions judge had effectively weighed the evidence and decided a merits issue—whether the alleged violation of privacy was intentional—based on her interpretation of the online privacy declaration. This exceeded the limited “filter” function at authorization, which is designed only to weed out claims that are plainly frivolous.

The appellate court carefully examined the privacy declaration and the Commissioner’s report. It highlighted that the declaration referred to using de-identified information “for internal business purposes” and to sharing personal information with third parties for Home Depot’s own professional purposes. It did not, however, clearly disclose that customers’ emails and purchasing data would be communicated to Meta for the purpose of measuring ad conversions or for Meta’s own targeted advertising unrelated to Home Depot. The Commissioner had likewise criticized the vagueness of the language, noting that generic phrases like “improving products and services” and sharing data “for business purposes” would not allow an average customer to reasonably understand that their data could be transmitted to Meta and used as described.

In light of these materials, the Court held that it was open, at least in argument, to characterize Home Depot’s conduct as an intentional and unlawful interference with online customers’ privacy, and it was not for the authorization judge to conclusively determine intent and legality at this stage. The Court therefore ruled that online purchasers must be brought within the authorized class, both for punitive and for compensatory damage claims, and adjusted the group definition accordingly.

Court of Appeal’s approach to multiple legal bases (L.p.c. and Competition Act)

The Court used this case, together with its companion decision Gauthier c. Bombardier, to clarify how article 575(2) C.p.c. should be applied when multiple substantive legal bases are invoked in support of the same monetary conclusion. It held that the authorization judge’s task is to determine whether the conclusions sought appear justified in light of the alleged facts and at least one defensible legal foundation. Once a conclusion—such as a claim for compensatory damages or punitive damages—is defensible on one legal basis, the judge need not and generally should not sift through and eliminate every additional doctrinal foundation at the preliminary stage, absent exceptional circumstances. Those alternative grounds may be fully argued at trial.

Applying this framework, the Court of Appeal found it unnecessary to definitively rule at authorization on whether the L.p.c. applied to the representations about email collection and data sharing, because the compensatory and punitive damage conclusions were already defensible under the Civil Code and the Charter. It did, however, note that the authorization judge had erred in assuming that key L.p.c. provisions on misleading representations (articles 219 and 228) apply only in the pre-contractual phase; later jurisprudence has confirmed that they can also operate in the contractual documentation itself.

The Competition Act claim required a separate analysis because it was the sole legal basis for one specific conclusion: recovery of the full costs of the proceeding under section 36(1), which allows an “additional amount” equal to the plaintiff’s investigation and litigation costs. The Court concluded that the pleadings supported a non-frivolous argument that Home Depot’s representations to customers about the use of their email addresses, in the context of providing receipts, were false or misleading in a material respect, and that such conduct could qualify as promotional activity for “any business interest” within the meaning of section 52(1). Combined with the non-trivial prospect of economic loss from unauthorized data use, this was sufficient to revive the Competition Act question and the associated conclusion about investigation and proceeding costs.

Treatment of individuals without Facebook accounts

The Court of Appeal upheld the authorization judge’s exclusion of individuals who did not have Facebook accounts from the class definition. Relying on the Commissioner’s explanation of hashing and matching, the Court noted that Meta could only associate a hashed email with a specific person if that hashed value corresponded to an email already tied to a Facebook account. For non-Facebook users, the hashed address would not match any existing identifier, and thus no personal information about a particular individual could be inferred or linked to a profile. In other words, while their hashed emails were technically transmitted, that transmission did not yield any identifiable disclosure or exploitable profile at Meta’s end. In these circumstances, the Court considered it within the trial judge’s discretion at authorization to craft a class definition that excluded non-Facebook users, and it found no basis to interfere with that narrowing.

Reformed authorization and outcome

In its dispositive orders, the Court of Appeal allowed the appeal in part with costs, partially set aside the Superior Court judgment, and substituted new key paragraphs. It redefined the class as all persons with Facebook accounts who purchased or rented goods or services in Québec at a Home Depot store or on its Homedepot.ca website and who provided an email address between January 1, 2018 and October 30, 2022. It expanded the list of common issues to cover: whether Home Depot collected, used, and communicated class members’ personal information; whether it did so without valid consent; whether, to promote business interests, it made false or misleading representations about such use; what the value of the personal information communicated to third parties is; whether compensatory and punitive damages are owed and in what amounts; and whether class members can recover their investigation and proceeding costs under the Competition Act. The Court also reinstated the full set of conclusions sought, including collective recovery of an amount equal to the value of the data, CAD 10 million in punitive damages, and an additional amount for the full costs of the proceedings.

In terms of practical outcome, the Court of Appeal’s decision does not itself award any damages or quantify any recovery. It authorizes a broader and more robust class action to proceed to the merits, with online customers included and both compensatory and punitive damages, as well as Competition Act costs, left on the table for adjudication. Option Consommateurs is the successful party in this appeal, having expanded the scope of the class and revived additional heads of claim, and it is awarded its appeal costs against Home Depot. However, no specific monetary amount is ordered in its favor beyond this entitlement to costs, and the total quantum of any damages, costs, or collective recovery cannot yet be determined from this authorization judgment alone.