Online Retailers (Top 10) · Online/Retail (home improvement) · Data breach
The Home Depot
Headline
Home Depot has the most extensively documented surveillance-related findings of any retailer in this tracker, and the structural reason is that a home improvement retailer sits at an unusually revealing intersection…
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
Home Depot has the most extensively documented surveillance-related findings of any retailer in this tracker, and the structural reason is that a home improvement retailer sits at an unusually revealing intersection: purchase history reveals whether you are renovating, what you are building, and by inference your property, your finances and your plans. Combine that with in-store analytics, loyalty data and website tracking and the profile is considerably richer than the transaction log suggests. Home Depot's 2014 payment card breach was also among the largest retail breaches on record. See the Data Sharing column for the itemised findings.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
A THIRD-PARTY SaaS VENDOR breach exposed private data of ~10,000 Home Depot EMPLOYEES; separately, in September 2014 Senators Blumenthal and Markey called on the FTC to investigate whether Home Depot's security procedures meet a 'reasonable standard' in response to the 2014 payment card breach (that letter predates and does not concern the vendor/employee breach). A 2026 shareholder proposal by Zevin Asset Management (not Home Depot itself; the Board recommended against it) argues that 'meaningful independent verification of authorized use is not currently possible' for vendor-managed surveillance networks and cites 'governance gaps in downstream data sharing.'
Data sharing
MOST EXTENSIVELY DOCUMENTED SURVEILLANCE-RELATED FINDINGS OF ANY COMPANY IN THIS TAB: (1) A 2026 shareholder proposal by Zevin Asset Management (SEC exempt-solicitation filing, PX14A6G; Home Depot's Board recommended against the proposal) states that Home Depot deploys FLOCK SAFETY AUTOMATED LICENSE PLATE RECOGNITION (ALPR) cameras across its parking lots and that federal IMMIGRATION ENFORCEMENT accessed Flock network data through local law enforcement intermediaries, citing Reuters and 404 Media reporting. A 2026 California class action (McGinity v. The Home Depot, filed April 10, 2026 in Contra Costa Superior Court and removed to N.D. Cal., No. 4:26-cv-03103) alleges Home Depot's Flock ALPR use violates California's ALPR law (Civ. Code § 1798.90 et seq.); a second federal suit, Schmierer et al. v. Home Depot U.S.A., Inc. (N.D. Cal. No. 3:26-cv-03967, filed May 1, 2026), was related to that case on May 26, 2026, and the earlier docket is now captioned In re: Home Depot ALPR Litigation; no link between either suit and Home Depot's Dec. 29, 2025 privacy-statement revision was found. (2) Canada's Privacy Commissioner found (2023) that Home Depot shared E-RECEIPT DATA with Meta without valid consent. (3) An Illinois BIPA class action alleged Home Depot's SELF-CHECKOUT facial recognition cameras violated the state's biometric privacy law (this specific case is described as 'now dismissed' in a 2026 shareholder proponent's SEC filing — the dismissal was not verified against the court docket as of Oct 2026). (4) Separate class actions allege Home Depot embedded 'SESSION REPLAY' software that 'intentionally intercepted' users' electronic communications (2023), secretly let GOOGLE 'wiretap' customer service calls without consent (2024), and embedded hidden tracking technology in MARKETING EMAILS (2024).
Fees and billing
Not itemized separately from the above.
Contacts
Privacy contact. Not recorded.
Legal notice. PUBLIC COMPANY (HD). Service route: c/o General Counsel / Corporate Secretary, Atlanta, Georgia — the corporate address on the SEC Form 10-K cover page is the official address of record. Confirm the exact street address on the current 10-K at sec.gov/edgar, and check the state-of-incorporation registered agent (usually Delaware; most large filers use The Corporation Trust Company or Corporation Service Company) via the Secretary of State business-entity search. A registered agent MUST accept service, which is why it is the reliable channel when a company publishes no privacy address.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy homedepot.com/privacy/privacy-and-security-statement | Not fetched yet | NO (HTML only) |
| Terms of service homedepot.com/c/Terms_of_Use | Not fetched yet | NO (HTML only) |
| Website homedepot.com | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No comprehensive state privacy statute on file for Georgia