Home Depot Privacy Lawsuit: License Plate Cameras, Face Scanning, and Customer Data

Home Depot has faced several privacy suits in 2025 and 2026. They involve different technology, different laws, and different groups of shoppers.

License plate reader cameras in California

McGinity v. The Home Depot, Inc., No. 4:26-cv-03103, was filed April 10, 2026 in the Northern District of California. A related case, Schmierer v. Home Depot U.S.A., Inc., No. 3:26-cv-03967, followed on May 1, 2026 in the same court. The complaints allege that Home Depot uses automated license plate recognition, or ALPR, cameras from its vendor Flock Safety in the parking lots of its California stores.

According to the 57-page complaint described by ClassAction.org, the cameras capture the license plate, make, model, color, and "distinguishing features" of every vehicle that enters or leaves, log it with precise times and locations, and send it to a "centralized, searchable database" that law enforcement agencies across the country can access. The plaintiffs say Home Depot failed to meet California's ALPR law because it did not name an official custodian, set a retention period, restrict sharing with federal or out-of-state agencies, or describe training and accuracy measures.

Face scanning at self-checkout in Illinois

Jankowski v. The Home Depot, No. 1:25-cv-09144, filed August 1, 2025 in the Northern District of Illinois, alleged that self-checkout kiosks used "computer vision" cameras to capture shoppers' facial geometry without the written consent required by the Illinois Biometric Information Privacy Act. Snopes reported that the plaintiff later dropped the case, leading to its dismissal. That suit is often confused with the license plate cases.

Sharing shoppers' purchase data

Wright v. The Home Depot, Inc., No. 2:26-cv-00683, was filed July 1, 2026 in the Eastern District of Virginia. Coverage of the complaint says it accuses Home Depot of selling or sharing customers' purchase information with third parties for advertising, including through its retail media business, without the notice Virginia's Personal Information Privacy Act requires.

E-receipts shared with Meta in Canada

In Canada, the federal privacy commissioner found on January 26, 2023 that Home Depot of Canada sent in-store customers' hashed email addresses and purchase details to Meta when they asked for e-receipts, without valid consent. A British Columbia court later certified a class action over that practice. It covers Canadian shoppers only.

Case	Court	Status
McGinity (license plates)	N.D. Cal.	Pending
Schmierer (license plates)	N.D. Cal.	Pending
Jankowski (face scans)	N.D. Ill.	Dropped by plaintiff
Wright (data sharing)	E.D. Va.	Pending

As of September 26, 2026, no court has certified a class, ruled on the merits, or approved a settlement in any of the U.S. Home Depot privacy cases on this page. Home Depot is represented by Jones Day in the license plate litigation, according to court records reported by the Daily Journal. The allegations are unproven.

Social media has run ahead of the facts. In July 2026, viral videos told shoppers Home Depot "could owe you up to $2,500" for scanning faces and plates. Snopes rated those claims a mixture of true and false: the lawsuit is real, but the complaint says nothing about faces, and the $2,500 figure is a statutory minimum per person if a violation is proven, not a promised payment. Flock told Snopes that its products "do not have facial recognition." Many of those posts ended with pitches for paid claim-tracking apps. You never need to pay anyone to be part of a class action. See our guide to settlement scams.

Automated license plate readers are cameras, usually on poles near entrances, that photograph every passing vehicle and convert the plate to text. According to the California complaint, Home Depot's system logs the plate along with the vehicle's make, model, color, and distinguishing features, plus a timestamp and location, and adds it to a centralized, searchable database.

The privacy concern is less about one photo than about the pattern. A single store visit reveals little. Many visits, combined with readers at other businesses and on public roads, can show where a person shops, works, worships, or seeks medical care. The complaint alleges Home Depot's data is accessible to law enforcement agencies nationwide, without meaningful limits on sharing with federal, out-of-state, or immigration agencies.

The plaintiffs also point to reports about Home Depot's vendor. They allege that Flock re-enabled nationwide data-sharing settings, without authorization, on cameras used by law enforcement agencies in Mountain View and Ventura County. Those are allegations in the complaint, not findings, and Flock is not a defendant in the Home Depot cases. The complaint adds that license plate data has commercial value because data brokers can combine it with other records for ad targeting and profiling.

California's ALPR law does not ban license plate readers. It requires operators to publish a usage and privacy policy, name who is responsible for the system, set how long data is kept, and control who can see it. The lawsuit's core claim is that Home Depot skipped those steps, not that using cameras in a parking lot is illegal in itself.

The court has not defined a class. Based on the complaints, the people most likely to be covered are:

• People whose vehicles entered the parking lot of a Home Depot store in California where ALPR cameras operated.
• California residents, since the claims rely on California law. The complaint describes the cameras as deployed across Home Depot's California stores.
• Drivers of vehicles registered in their name, since the data is tied to the plate.

Who probably does not qualify:

• Shoppers outside California for the ALPR claims. Most states have no private right of action for license plate data.
• Illinois shoppers hoping to join the self-checkout face scan case, which was dropped.
• Anyone expecting an automatic $2,500. That figure only applies if a court finds a qualifying violation and harm, and class settlements usually pay less.

If you are unsure whether the store you visited had cameras, look for tall poles with a small camera and a solar panel near the parking lot entrances, which is how Flock readers typically appear. Your own records matter more, though: receipts or card statements showing visits to California Home Depot stores are the kind of proof a settlement could ask for later. Keep them, because many people shop there for years and records of older visits can be hard to recreate.

Canadian shoppers who used e-receipts in British Columbia should follow the B.C. class action instead. For how proposed classes are defined, see our guide on class certification.

No Home Depot privacy case has a settlement or a verdict, so there is no payout estimate. Here is what the laws in play allow:

Law	Who it covers	Damages
California ALPR law	People harmed by ALPR violations	At least $2,500 liquidated
Virginia VPIPA	Virginia store purchasers	$100 per violation
Illinois BIPA	People scanned in Illinois	$1,000 to $5,000

Under Cal. Civ. Code § 1798.90.54, a court may award actual damages, "but not less than liquidated damages in the amount of two thousand five hundred dollars ($2,500)," plus punitive damages for willful violations and attorney fees. The statute also requires that the defendant "knowingly caused the harm," which Home Depot is likely to contest. The Virginia statute allows $100 per violation in statutory damages plus fees, according to Troutman Pepper Locke's analysis.

Class settlements under privacy statutes with large minimums often pay far less than the minimum per person, because the defendant's total exposure would otherwise be enormous. Our page on BIPA lawsuits shows how that played out in real biometric settlements.

California's ALPR law, Civil Code §§ 1798.90.5 to 1798.90.55. Passed in 2015 and effective January 1, 2016, it requires businesses that operate license plate readers to maintain security, publish a usage and privacy policy, name a custodian, set retention rules, and limit how data is shared. People harmed by violations can sue.

Virginia Personal Information Privacy Act. It bars merchants selling goods from a fixed retail location in Virginia from selling purchaser information gathered in a sale to third parties unless they give adequate notice and honor customer requests not to sell. It has rarely been tested in court.

Illinois BIPA. Requires written notice and a signed release before collecting face geometry or other biometrics. It was the basis of the dropped self-checkout case.

California constitutional privacy and the CCPA. Some complaints add claims under California's constitutional right to privacy and consumer privacy laws. Our California Invasion of Privacy Act entry explains a related statute often used in tracking cases.

• No settlement deadline exists because nothing has settled.
• Class membership is automatic while the proposed class actions are pending, and filing generally pauses the statute of limitations for people in the proposed class.
• Individual claims have their own limits. Limitations periods vary by law and claim, and the BIPA limit is five years. An attorney can check your dates.

If a settlement is reached, the notice will set a claim deadline and dates to opt out or object.

1. Gather proof of visits: receipts, card statements, or app purchase history with store locations and dates.
2. Note your plate and vehicle. The ALPR claims tie data to your plate, so keep records of the vehicles you drove and when, especially if you changed cars or plates in recent years.
3. Ignore paid "claim" apps and posts promising $2,500. No claim process exists.
4. Limit data sharing going forward: check your Home Depot account privacy settings and opt out of data sales where the site allows.

Independent attorneys who handle privacy cases can tell you whether you fit one of these proposed classes. A free case review takes about two minutes. For other retail and app tracking cases, see our pages on Yahoo tracking and Google privacy lawsuits.