An exploratory analysis examining Home Depot consumer “Personal Information Reports” raises questions about the scope of personal information collected, inferred, and shared by the world's largest home improvement retailer based on 2025 net sales.
By analyzing reports from 10 Home Depot customers across four states, researchers across New York University, Columbia Law School, and Northeastern University found that the company cultivates detailed customer profiles extending well beyond purchase histories. The “personal information reports” show a wide range of information about customers, including inferred number and ages of children, financial behavior, education, occupation, and geolocation data.
Summary of Findings
The researchers reviewed consumer data rights reports provided by Home Depot customers and identified several categories of inferred and collected information:
-
Household and family inferences. The reviewed reports include inferences about household child profiles, including the presence, number, and age ranges of children.
-
Extensive geolocation data. The reviewed reports contain geolocation information, including IP-based location data, which may or may not correspond to individuals' actual physical locations, including where they live or where they traveled.
-
Socioeconomic profiling. The reviewed reports include inferences about financial behavior, educational attainment, and occupational classifications.
-
Multiple pathways for data collection. Home Depot documents numerous ways it can collect user information, including through online account activity, promotional communications, enrollment in the PRO Xtra loyalty program for large-volume purchasing businesses, and PRO Referral online accounts for contractors, workers, and professionals.
-
Inaccurate consumer profiles. The reviewed reports contain incorrect information, resulting in profiles that misrepresent individuals and, in some cases, their households and families.
-
Opaque data sharing. Home Depot states that it collects, shares, or monetizes customer information through numerous third-party data brokers, making it difficult to determine how information about customers is obtained and used.
Beyond being a retailer, Home Depot operates a contractor marketplace (Pro Referral) that connects customers with independent service professionals and an in-house retail media network (Orange Apron Media) that enables brands to advertise across its digital and in-store channels.
“For years, researchers have identified how companies silently and extensively track your online activities via website visits and mobile app usage,” said David Choffnes, Professor of Computer Science at Northeastern University. “Through these investigations, we learn that such practices extend even to services as basic and important as your hardware store.”
“People are usually the last to find out how their data – accurate or not – is being used against them – in terms of the prices they're offered, the options they see, and the opportunities they get,” said Stephanie T. Nguyen, Senior Fellow at Columbia Law School's Center for Law and the Economy. “This asymmetry isn't an accident. It's what makes the commercial surveillance model profitable.”
The authors conclude with questions that regulators and policymakers can ask retailers regarding their hidden practices.
“The web of data brokers and ad partners is so opaque and tangled that most people have no real way to know who holds their data, how it's used, or how to opt out,” said Damon McCoy, Co-Director of the NYU Center for Cybersecurity.
Consumers routinely walk into a brick-and-mortar home improvement store to address do-it-yourself repairs or maintenance needs – to repair a toilet, install a light fixture, or fix a leaky faucet. What can easily start off as an ordinary errand for working people can double as another pathway to fuel a commercial surveillance engine.
The researchers argue that the burden should not fall solely on consumers to monitor and manage their own data. Companies should be responsible for complying with privacy laws and providing meaningful transparency about how personal information is collected, inferred, shared, and used.
Consumers who want to request their own Home Depot data can do so here: Home Depot Privacy Rights Request Portal.
About the Research
This research was conducted with support from Cat Mai, Computer Science Ph.D. Candidate at New York University, and Zachary Harris, Program Manager at the Center for Law and the Economy at Columbia Law School.
About NYU Center for Cybersecurity
The NYU Center for Cybersecurity brings together researchers across disciplines to address emerging challenges in cybersecurity, privacy, and the responsible use of technology.
About Columbia Law School's Center for Law and the Economy
The Center for Law and the Economy at Columbia Law School advances the study, practice, and implementation of laws and policies that structure the U.S. economy. The center brings together experienced policy advisors, technologists, attorneys, researchers, and scholars to develop timely research across antitrust, consumer protection, financial regulation, technology policy, and other areas of public economic law.
About Northeastern University's Khoury College of Computer Sciences
At Khoury College, we believe that CS is for everyone, and everyone should benefit from CS innovation. Our interdisciplinary programs and global learning opportunities directly respond to the needs of our technology-driven world, preparing students for exciting and meaningful careers across diverse fields. Our impact in computer science is driven by groundbreaking research, a rigorous curriculum, transformative experiential learning opportunities, and our collaborative, inclusive community.