Retailers collect data on their customers. In some cases, that information isn’t accurate
A group of researchers including at Northeastern University sought to understand what type of data home improvement retailer Home Depot collected on its customers — and why bad data isn’t good.
Christo Wilson is a regular customer at Home Depot. You can reliably find him in the aisle of the home improvement chain every spring, reupping his stock of perennials, shrubs, mulch and other gardening supplies to keep his extensive landscaping looking its best.
Wilson, a professor in Northeastern University’s Khoury College of Computer Sciences, lives in a four-person household with his wife and their two young children. But to Home Depot, Wilson is a Western European woman living with six other people. That’s according to his customer data profile, a collection of personal information compiled by the company, that he requested from Home Depot.
An intercollegiate cohort of researchers recently published a report that shows the type of data that Home Depot collects on its customers, what personal details are inferred about them and several instances in which that data is incorrect. The personal data collected by any entity, including big box retailers like Home Depot, has the potential for implications for a person’s life, from how products and services are marketed to them to whether they might miss out on job notices or credit offerings, especially if the data on which their profile is based is wrong.
The report outlines that Home Depot, which bills itself as the “world’s largest home improvement retailer,” “had a lot of information you don’t expect your hardware store to have about you,” said David Choffnes, a professor in Khoury College and an author of the report.
“We didn’t expect anything interesting to be there at all, and nonetheless found a lot of things we didn’t expect,” he said.
Through the data it collects, researchers found that Home Depot makes inferences about a customer’s household, family, finances, education and jobs; has an extensive geolocation data; and creates profiles with inaccurate information, known as “junk inferences.”
The findings were based on data provided to Choffnes and his team by 10 people, including Wilson, across four states. While it’s a small pool of people, it helped shape a wider data collection study the cohort is currently working on, Choffnes said.
What the 10 people provided to the researchers was what’s known as a “Personal Information Report” that the participants requested from Home Depot.
Those reports include information that Home Depot gathers from its website and store visits as well as third parties for a range of reasons, including customer care, fraud protection, personalizing content and “learning about customer trends and interests.” All this information is described on the Home Depot website, which also notes that it shares information it collects to entities like marketing and advertising partners, financial service companies, service providers and “any successor to part of our business.”
Editor’s Picks
What the report found was that none of the participants gave Home Depot information on the number of children they had, but several reports included inferences like “known child” or “likelihood of children.” One participant’s data report included several geolocations, many of which that participant had never been to, leading researchers to believe there was some mixing of data sources or a level of data entanglement, where the information collected about a person is muddled with someone else’s because of a shared location, such as an apartment complex, or from the use of shared devices, like if several people use the same laptop or iPad to surf the web or make purchases.
In another example, a 20-something college student participant with a roommate was grouped in with “urban-core middle-aged renters with children.” Their household was also incorrectly labeled as a home business.
The data reports from 8 of the 10 participants had inferences about their credit card use, education or job. Four of six participants who had job inferences said their reports were not correct. All 10 had an online account with Home Depot, which is one way how the company collects data.
“There is a whole ecosystem of data brokers whose sole business is selling data like this,” Wilson told Northeastern Global News, who also studied this phenomenon in 2019 and found that much of the information being shared by data brokers is incorrect. “These [new] findings throw this whole business model into doubt. Why should businesses pay top dollar for questionable data?”
The report from the cohort of researchers from Northeastern, New York University and Columbia University also highlights that bad data can influence whether a person has access to a job or house listing, insurance rates or credit offers. The information gathered on someone can also be used to suggest specific options to a person, “which diminishes what appears to be a freely made decision,” the report said.
Among the potential harms from incorrect data includes the practice of surveillance pricing, where personal data is used to influence the cost of a product or service. This month, the Senate Judiciary Committee held a hearing on the bipartisan issue of AI surveillance pricing, during which lawmakers emphasized their concern that consumers were on the losing side when artificial intelligence and personal data is used to adjust costs.
The report emphasized that it was not accusing Home Depot of these potential harms, but rather pulling from past research on what can happen when this type of data is collected and used.
A Home Depot spokesperson told NGN that the company “believe(s) in being good stewards of any customer information we have, and we respect our customers’ privacy rights.” Its customers can ask that their information be corrected or deleted and opt out of selling or sharing their data, the company said.
“We do not use inferences or socioeconomic data to provide discounts. We might use this type of data to personalize a customer’s experience on our website or the emails they receive from us,” the spokesperson said. The representative added that any discount programs the company has are ones that the customer opts into and is meant for bulk buyers, such as contractors or people who served in the military.
Even if a consumer seeks to correct the data that a big box retailer has on them, there’s no telling if that retailer has already sold incorrect data to a third party, Choffnes said.
More than 20 states, including California and Texas, have consumer data privacy laws on the books that grants consumers more power over their data. Massachusetts is currently considering its own law, with versions passed in the House and Senate.
“The problem is that when everyone is compiling data like this and we don’t know how it’s used, that leads to this problem. We should understand what data people have, how it’s being used and give consumers the opportunity to not have that be collected and used in that way,” Choffnes said.
Northeastern Global News, in your inbox.
Sign up for NGN’s daily newsletter for news, discovery and analysis from around the world.
