Marcela Pinilla Director of Sustainable Investing
Ahead of The Home Depot's 2026 Annual Meeting of Shareholders, Zevin Asset Management has filed a shareholder proposal asking the company to report on data privacy risks associated with its use of Flock Safety — a surveillance vendor whose network has been repeatedly accessed by federal immigration enforcement through local police intermediaries.
Specifically, the proposal focuses on how the company identifies, measures, and mitigates risks related to potential access or use of that data by third parties, including law enforcement agencies beyond its direct control.
(Item #8 in the 2026 Proxy Statement, p. 51)
Background
Home Depot shares data from its Flock Safety automatic license plate reader (ALPR) cameras with local law enforcement on a standing-access basis. This means agencies can query Home Depot's data at any time, without the company's involvement in each search.[1]
State audit logs from 2024–2025 show federal immigration enforcement accessed Flock's network through local police intermediaries in Virginia, Colorado, Georgia, and Washington state- without retailer authorization and in some cases without the knowledge of local agencies.[2]
More than 4,000 immigration-related lookups were identified in Flock audit logs. Flock initially denied facilitating federal access, then acknowledged a pilot program with CBP and Homeland Security Investigations and paused federal access after public exposure.[3]
Home Depot's parking lots have been frequent sites of ICE enforcement activity. This creates the potential for visitor data to be accessed via the Flock Safety network for purposes beyond Home Depot's stated intent of asset protection and customer safety. Without control or visibility into downstream use, Home Depot may be channeling data from every vehicle entering or departing its parking lots into a network that law enforcement has queried repeatedly.[4]
The Investor Case
Home Depot states it has not authorized federal access—but it does grant standing access to local law enforcement, whose data can then flow through Flock's network to federal agencies without triggering any additional authorization.[5]
From the fall of 2025 to early 2026, investor co-filers corresponded and held three meetings with Home Depot. Despite our discussions, Home Depot did not fully address how data is used once it leaves Home Depot's systems. The terms governing law enforcement access do not specify the scope of permissible uses with sufficient precision, and the company has not yet established the downstream accountability mechanisms investors have requested.
Flock's architecture—standing query access, shared hotlists, and a national lookup feature—creates pathways to federal enforcement that bypass Home Depot's controls entirely. This remains an exposed and escalating risk.
As of April 2026, over thirty towns, cities, and counties have canceled, terminated, or suspended Flock Safety contracts since early 2025[6], with the pace accelerating sharply in early 2026 following Mountain View, CA’s termination of its Flock contract after discovering federal agencies accessed its data through a nationwide setting Flock had enabled without the city's knowledge.[7]
Home Depot’s Statement in Opposition and Unresolved Risks
The Board’s opposition statement describes an internal governance framework — including the Privacy and Data Governance Committee (PDGC), Data Security and Privacy Governance Committee (DSPG), and Third-Party Risk Management (TPRM) program as sufficient, and committed to supplementing disclosure in its upcoming Living Our Values Report.[8]
Investors met with Home Depot management; the company confirmed no federal agency has been authorized to access ALPR data and disclosed that a secondary internal review had been conducted.
The documented “side door” access pathway, through which local agencies act on behalf of federal authorities using their own credentials was not addressed;[9] the federal-agency exclusion exists only in the proxy, not in Home Depot’s public-facing privacy policy;[10] No independent validation of the audit methodology was provided.
Investors submitted follow-up questions regarding data governance and oversight of 287(g) agreement jurisdiction, a rigorous understanding of the purposes of the audit independence, Flock network architecture, and what the Living Our Values Report will actually contain.
Home Depot responded, confirming escalation protocols are being formalized but providing no new commitments on independent audits, downstream use restrictions, or aggregate access data disclosure.
Emerging legislative risk: California REPAIR Act (SB 1103)
The California Senate Judiciary Committee passed legislation on April 21, 2026 that would require Home Depot to publicly disclose immigration enforcement activity at its stores, in part because the company had not done so voluntarily. If enacted, the bill would mandate by law what the Board has described as already addressed "in an appropriate and sufficient manner through existing Board and management oversight."¹ The gap between the company's current posture and evolving legislative expectations is a material risk. The report requested in Item 8 would give the Board and shareholders a structured framework for assessing whether existing governance is keeping pace.
Conclusion
Ultimately, the issue is not whether Home Depot intended for this access to occur, but whether its current oversight is sufficient to prevent it. Without clearer controls and transparency around downstream data use, investors are left exposed to material regulatory, reputational, and human rights risks. A formal Board-level assessment would provide needed clarity and accountability.
Documents:
· Home Depot Shareholder Proposal (Item #8, p. 51)
· Exempt Solicitation (forthcoming)
We welcome your questions and comments at invest@zevin.com
References:
[1] 404 Media / EFF, Johnson County TX public records, Aug. 2025. 404media.co · FOIA records (PDF)
[2] VCIJ at WHRO, Virginia Flock network, Jul. 2025. vcij.org; Colorado Newsline, Denver audit logs, Aug. 2025. coloradonewsline.com; Atlanta Community Press Collective, Nov. 2025. atlpresscollective.com;
UW Center for Human Rights, "Leaving the Door Wide Open," Oct. 2025. jsis.washington.edu
[3] EFF / MuckRock FOIA records. JCSO_Agency_Sharing.pdf; 404 Media, "ICE Taps Into Nationwide AI-Enabled Camera Network," May 2025; Institute for Justice, Aug. 2025. ij.org
[4] KPBS, San Diego private ALPR networks, Nov. 2025. kpbs.org
[5] Home Depot ALPR Privacy Policy
[6] NPR, February 17, 2026. "Why Some Cities Are Canceling Flock License Plate Reader Contracts"
[7] Immigration Policy Tracking Project . immpolicytracking.org; Mountain View Voice, Jan. 2026. mv-voice.com; Flock National LPR Network product page. flocksafety.com
[8] https://ir.homedepot.com/~/media/Files/H/HomeDepot-IR/2026/The%20Home%20Depot%20Inc%20-%202026%20Proxy%20Statement.pdf
[9] VPM News, October 9, 2025. https://www.vpm.org/news/2025-10-09/flock-safety-cameras-alprs-federal-immigration-enforcement-lehmann-kochis; University of Washington Center for Human Rights — "Leaving the Door Wide Open: Flock Surveillance Systems Expose Washington Data to Immigration Enforcement," October 21, 2025 https://jsis.washington.edu/humanrights/2025/10/21/leaving-the-door-wide-open/
[10]The Home Depot Privacy and Security Statement, including ALPR Usage and Privacy Policy, last revised December 29, 2025, available at homedepot.com/privacy. The federal-agency exclusion stated in the proxy does not appear in this operative document.
Disclosures: Registration with the SEC should not be construed as an endorsement or an indicator of investment skill, acumen or experience. Investments in securities are not insured, protected or guaranteed and may result in loss of income and/or principal. This communication is distributed for informational purposes, and it is not to be construed as an offer, solicitation, recommendation, or endorsement of any particular security, products, or services. Nothing in this communication is intended to be or should be construed as individualized investment advice. All content is of a general nature and solely for educational, informational and illustrative purposes. This communication may include opinions and forward-looking statements. All statements other than statements of historical fact are opinions and/or forward-looking statements (including words such as “believe,” “estimate,” “anticipate,” “may,” “will,” “should,” and “expect”). Although we believe that the beliefs and expectations reflected in such forward-looking statements are reasonable, we can give no assurance that such beliefs and expectations will prove to be correct. Various factors could cause actual results or performance to differ materially from those discussed in such forward-looking statements. All expressions of opinion are subject to change. You are cautioned not to place undue reliance on these forward-looking statements. Any dated information is published as of its date only. Dated and forward-looking statements speak only as of the date on which they are made. We undertake no obligation to update publicly or revise any dated or forward-looking statements.