Home Depot Hid Tracking Pixels in Marketing Emails, Violated Ariz. Law: Complaint

Home Depot “deceptively embedded spy tracking pixels in marketing emails” it sent to consumers, alleged a privacy class action Tuesday (docket 2:24-cv-00730) in U.S. District Court for Arizona in Phoenix. The suit alleges Home Depot and tracking software company Validity violated Arizona’s Telephone, Utility and Communication Service Records Act (A.R.S).

Ivonne Carbajal of Maricopa County, Arizona, has “frequently received” and opened emails from the defendants over the past two years, most recently in March, said the complaint. Each time the plaintiff opened a Home Depot marketing email, the defendants “procured information identifying her and disclosing when she opened and read the email through the email tracking software embedded in the emails,” it said.

The defendants never received lawful and valid consent from Carbajal to obtain her private email records or the information their “spy tracker obtained,” the complaint said. Arizona law prohibits the practice of embedding “spy pixels” in emails, it said, noting a 2018 Princeton study that determined 70% of emails from 900 senders offering mailing list subscriptions contained software trackers.

The spy pixels, small and “impossible to spot” so they blend in with the background of an email, measure various metrics “while gathering information about email recipients,” the complaint said. The objective of a spy pixel is to “collect information without the knowledge of the recipient,” it said.

When a recipient opens one of the tracked emails, the following information is reported: if and when the email is read, and how many times, the IP address and other “unique identity details of the computer or smartphone used to read the email,” and the recipient's geographical location, the complaint said. Spy pixels are activated when recipients open the email, it said.

Validity markets its Everest email tracking system as a platform that “provides crucial insights and guidance so you can reach more people, increase engagement, and protect your email performance.” Everest lets Home Depot filter its engagement data by mailbox provider, platform and location to understand “understand high- and low-performing segments,” it said. To get a “complete view” of email performance, Home Depot created an “Everest tracking pixel” to capture customer engagement data, it said.

The tracking pixel can record recipients or values associated with the recipients, individual email campaigns, and additional custom properties via personalization tokens that collect engagement data on individual email recipients, the complaint said. Engagement data includes average read time of an email, unique opens per email address, whether an email was printed, how long it was looked at and whether it was forwarded, it said.

A second tracking pixel the defendants embed in emails allows them to track engagement data for every email recipient. The second pixel can be seen in the HTML code in a Home Depot email, said the complaint, showing a redacted line of code.

A.R.S. “prohibits procurement of any ‘communication service record’ (including email records) of ‘any resident of this state without the authorization of the customer to whom the record pertains, or by fraudulent, deceptive, or false means,’” the complaint said. Each time the defendants sent an email containing a spy pixel to Carbajal and class members, the defendants “procured a communication service record," thus committing a separate violation of A.R.S., it said.

Carbajal seeks judgment against the defendants including actual damages of $1,000 for each A.R.S. violation, damages equal to the sum of profits the defendants made for each violation, injunctive relief, and an award of attorneys’ fees and costs, plus pre- and post-judgment interest.