The Privacy Commissioner has published a pretty extensive report https://www.priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-into-busines

The Privacy Commissioner has published a pretty extensive report https://www.priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-into-businesses/2023/pipeda-2023-001/ https://www.priv.gc.ca/en/opc-actions-and-decisions/investig... Basically boils down to Home Depot didn't get proper consent before sharing personal information with Facebook. They have been asked very politely to not do that anymore. Canadian privacy law is very odd. It was one of the earliest such laws (pre-dates GDPR by 10+ years) and it's very comprehensive, but it has almost no teeth. The privacy commissioner has broad power to investigate information handling by private companies but then isn't able to do much beyond recommend changes. I think the maximum penalty is around $100,000, which might as well be 0.