Governance document

CA-D-000621

Home Depot Privacy Policy

Home Depot

Last change detected July 1, 2026 Privacy policy

SHA-256: 93154b5f9159e93c13c… 3 versions captured 2 changes documented

Get the research letter

Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.

View original document at Home Depot ↗

This page describes what the document states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability may vary by jurisdiction. Methodology

80 Total

29 High severity

38 Medium severity

13 Low severity

Key Facts

Who does Home Depot limit authorization to access ALPR data to?

Home Depot limits authorization to access ALPR data to select associates and independent contractors who have an Authorized Purpose, including those in security, asset protection, information technology, and legal departments.

What must associates and independent contractors have to access ALPR data?

May Home Depot collect and use Automatic License Plate Reader (ALPR) information?

Home Depot may collect and use Automatic License Plate Reader (ALPR) information for fraud prevention, security, and asset protection purposes.

What identifiers does Home Depot collect?

Home Depot collects identifiers including name, email address, phone number, username, physical address, device identifier, IP address, government-issued identification number, date of birth/age, license plate number, and tokenized payment information.

May Home Depot use session replay software to record and replay a user's interaction on its websites or applications?

Home Depot may use session replay software to record and replay a user's interaction on its websites or applications.

Does Home Depot recognize the Global Privacy Control (GPC) signal to allow consumers to opt out of the sale and sharing of their personal information for targeted advertising on homedepot.com?

Home Depot recognizes the Global Privacy Control (GPC) signal to allow consumers to opt out of the sale and sharing of their personal information for targeted advertising on homedepot.com.

Can Home Depot promise completely safe use of its websites or mobile applications?

Home Depot states that the Internet is not 100% secure, that the security measures it uses are appropriate for the type of information it collects, and that it cannot promise completely safe use of its websites or mobile applications.

Will Home Depot disclose text messaging opt-in consent to third parties for their own marketing purposes?

Home Depot will not disclose text messaging opt-in consent to third parties for their own marketing purposes.

What consumer right does Home Depot recognize regarding personal information?

Home Depot recognizes a consumer right to request information about personal information that Home Depot collects, uses, discloses, shares, and sells, including requesting the specific pieces of personal information collected.

What right does Home Depot recognize for consumers to direct it not to sell or share their personal information?

Home Depot recognizes a consumer right to direct it not to sell or share their personal information and to opt out of certain targeted advertising where information is processed across unaffiliated or differently branded entities.

Stay ahead of the changes

Track Home Depot and get the diff the day its terms change.

Monitor Home Depot + up to 20 platforms — $4.99/mo →

Summary

Home Depot's privacy policy describes what personal information the company collects about you—ranging from your name and contact details to your device activity, license plate number, and how you navigate its websites—and how it may use or share that information, including with third-party advertisers. You have the right to ask what data Home Depot holds about you and to tell it not to sell or share your personal information, and you can exercise that opt-out automatically on homedepot.com by enabling the Global Privacy Control in your browser. Home Depot keeps your data for as long as it considers reasonably necessary, which may be after your relationship with the company ends, and it does not guarantee that its websites and apps are completely secure.

Analysis

The Home Depot Privacy Policy establishes the terms under which Home Depot collects, uses, retains, and shares personal information across its websites, applications, and physical properties. Collection spans a broad set of identifiers—including names, contact details, device identifiers, government-issued ID numbers, date of birth, license plate numbers, tokenized payment data, and behavioral data captured via session replay software—as well as Automatic License Plate Reader (ALPR) data gathered for fraud prevention, security, and asset protection. Home Depot may share non-directly-identifying data such as device identifiers, IP addresses, and browsing activity with select third parties for interest-based advertising, while committing not to share SMS opt-in consent with third parties for their own marketing. Consumers are recognized rights to access the specific pieces of personal information collected about them, and to direct Home Depot not to sell or share their personal information, including through browser-level Global Privacy Control signals on homedepot.com. Retention is governed by a 'reasonably necessary' standard applied at Home Depot's discretion, with no fixed endpoint, and Home Depot disclaims any warranty of complete security for its websites and mobile applications.

What this means for you

This policy means Home Depot collects a wide range of personal information about you—including identifiers tied to your physical presence (such as license plate data captured at its properties), your online behavior (including session replay recordings of how you interact with its sites), and your device and payment details. Home Depot may share non-directly-identifying data like your device identifier, IP address, and browsing activity with third parties for targeted advertising, though it will not share your SMS opt-in status with third-party marketers. You can request a full accounting of the specific pieces of personal information Home Depot holds about you, and you can direct Home Depot not to sell or share your personal information. One concrete action available to you: enable the Global Privacy Control signal in your browser to automatically opt out of the sale and sharing of your personal information for targeted advertising on homedepot.com.

Institutional Analysis

Stay ahead of the changes

Institutional analysis available with Insight

Which mapped governance frameworks each document engages, tied to the specific provisions that engage them.

Monitor Home Depot + up to 20 platforms — $4.99/mo → Get the research letter, free

2 important changes detected

3 versions captured · Last updated: July 2026

July 1, 2026

low

What changed Home Depot's privacy policy was updated on July 1, 2026 to expand a data-sharing disclosure that previously applied only to Rhode Island residents. The updated language now states that both Connecticut and Rhode Island residents can access a list of third parties to whom Home Depot has sold or may sell personal information. The change adds Connecticut residents to the existing Rhode Island disclosure requirement.

Why this matters The updated policy extends an existing data-sharing transparency mechanism to Connecticut residents that previously applied only to Rhode Island residents. Both states can now access a list of third parties to whom Home Depot has sold or may sell personal information by clicking a provided link. This change provides Connecticut residents with the same disclosure access that Rhode Island residents already had.

View full change record →

June 5, 2026

low

What changed Home Depot updated its privacy policy on June 5, 2026 to add explicit language stating: 'We will not disclose text messaging opt-in consent to third parties for their own marketing purposes.' This clarifies that when customers consent to receive text messages from Home Depot, that consent information itself will not be shared with third parties for those third parties' own marketing campaigns. The updated terms establish a boundary on consent data sharing that was not previously stated in the policy.

Why this matters The updated policy now explicitly states that Home Depot will not share your text message opt-in consent with third parties for their marketing purposes. This clarifies a boundary on how consent data is treated. You can review Home Depot's full privacy policy to understand other data collection and sharing practices.

View full change record →

Featured, High severity

ALPR Access Limited to Authorized Personnel Only Compare →

Access to sensitive license-plate and location data is nominally restricted, but the authorization standard—'Authorized Purpose'—is defined by Home Depot, leaving the scope of access within its discretion.

Added July 10, 2026 Standard Seen across 265 platforms
ALPR System Data Collection for Asset Protection Compare →

ALPR collection means Home Depot may capture and retain vehicle license plate data from individuals visiting its properties, linking physical presence to identifiable vehicle records.

Added July 10, 2026 Standard Seen across 296 platforms
Collection of Identifiers from Multiple Sources Compare →

The breadth of identifier categories—spanning physical, digital, governmental, and financial data—means Home Depot can build detailed profiles linking online and offline consumer identity.

Added July 10, 2026 Standard Seen across 296 platforms
Collection of Internet Activity via Session Replay Compare →

Session replay captures granular behavioral data—keystrokes, mouse movements, page navigation—beyond standard analytics, creating a detailed reproduction of a user's session.

Added July 10, 2026 Standard Seen across 296 platforms
Global Privacy Control Signal Recognition on homedepot.com Compare →

GPC recognition provides a browser-level opt-out mechanism, meaning consumers do not need to submit a manual request to exercise sale and sharing opt-out rights on homedepot.com.

Added July 10, 2026 Standard Seen across 290 platforms
Internet Not 100 Percent Secure Disclaimer Compare →

The disclaimer limits consumer expectations of guaranteed security and signals that Home Depot does not warrant against data interception or breach during transmission.

Added July 10, 2026 Standard Seen across 287 platforms
No Disclosure of SMS Opt-In Consent to Third Parties Compare →

This commitment prevents a consumer's SMS opt-in status from being sold or transferred to third-party marketers, limiting a specific vector for unsolicited commercial messaging.

Added July 10, 2026 Standard Seen across 288 platforms
Right to Know and Access Personal Information Compare →

This right gives consumers a mechanism to obtain a concrete accounting of what personal data Home Depot holds and how it is handled, enabling informed decisions about further engagement or opt-out requests.

Added July 10, 2026 Standard Seen across 290 platforms
Right to Opt Out of Sales Sharing and Targeted Advertising Compare →

This right directly limits Home Depot's ability to monetize personal data through sales or targeted advertising networks once a consumer exercises it.

Added July 10, 2026 Standard Seen across 290 platforms
SSL Encryption for Online Order Transmission Compare →

SSL encryption is a baseline security measure for protecting financial and personal data in transit; its use signals a minimum standard of transmission security for online orders.

Added July 10, 2026 Unique
Use of Information for Interest-Based Advertising Compare →

Although the shared data does not directly identify a consumer, device identifiers and browsing histories can be combined by third parties to build profiles that effectively identify individuals for targeted advertising.

Added July 10, 2026 Standard Seen across 279 platforms

Featured, Medium severity

Data Retention Based on Business and Legal Needs Compare →

The retention period is not fixed; Home Depot's discretion over what is 'reasonably necessary' means personal information may be held indefinitely beyond the active relationship.

Added July 10, 2026 Standard Seen across 275 platforms