Sephora USA, Inc., $1,200,000
First-ever public CCPA enforcement settlement. Sephora failed to disclose that it was selling personal information and did not honor Global Privacy Control opt-out signals.
Case identifiers
- Respondent
- Sephora USA, Inc.
- Agency
- California Attorney General
- Announced
- 2022-08-24
- Monetary relief
- $1,200,000
- Case number
- California AG Case No. RG22-141229
- Statutes cited
- California Consumer Privacy Act (CCPA)
Key facts
- 1
Sephora allowed third parties to install tracking software that captured customer data in exchange for free analytics and advertising services, a "sale" under CCPA.
- 2
Sephora’s privacy disclosures did not tell consumers their data was being sold.
- 3
Company also failed to honor Global Privacy Control (GPC) signals, a user-agent-level opt-out.
- 4
California AG Bonta chose Sephora as the flagship enforcement case to set precedent for the CCPA sale provision.
What the order requires
Injunctive terms imposed by the California Attorney General. These bind Sephora USA, Inc.'s data practices going forward.
- Required disclosure that the company sells personal information.
- Must provide mechanisms for consumers to opt out of sale including Global Privacy Control.
- Must conform contracts with service providers to CCPA requirements.
- Reporting requirements to the California AG for two years.
Primary sources
Read the original government documents. These are the authoritative records, everything on this page is derived from them.
- California Attorney General press releasehttps://oag.ca.gov/news/press-releases/attorney-general-bonta-announces-settlement-sephora-part-ongoing-enforcement
Generate requests in under 60 seconds
Generate a deletion request for $9
Where this action sits in the tracker
- It is one of 4 state-AG actions among the 26 cases in this tracker.
- Of the 19 tracked actions with monetary relief, $1,200,000 ranks number 16 by amount.
- 5 tracked actions were announced in 2022.
- It is one of 7 tracked data-broker actions.
- It is one of 6 tracked adtech actions.
FAQ
What did the state-AG charge Sephora USA, Inc. with?+
First-ever public CCPA enforcement settlement. Sephora failed to disclose that it was selling personal information and did not honor Global Privacy Control opt-out signals. The California Attorney General cited California Consumer Privacy Act (CCPA).
How much did Sephora USA, Inc. pay?+
Sephora USA, Inc. had monetary relief of $1,200,000, announced on 2022-08-24. The settlement also imposed injunctive terms (see below).
Does the Sephora USA, Inc. settlement mean my data has been deleted?+
No, the order does not automatically delete your data. You retain any rights available under applicable state privacy law (CCPA, CPA, TDPSA, VCDPA, and others) to submit your own deletion request. OfflistMe can generate a user-reviewed request draft pre-addressed to the respondent’s privacy contact.
How can I read the original state-AG order?+
The California Attorney General press release is available at https://oag.ca.gov/news/press-releases/attorney-general-bonta-announces-settlement-sephora-part-ongoing-enforcement. The case / matter number is California AG Case No. RG22-141229.