California Attorney General Rob Bonta announced yesterday a settlement reached with beauty product retailer, Sephora, Inc. (Sephora), resolving allegations that Sephora violated various provisions of the California Consumer Privacy Act (CCPA). Specifically, it was alleged that Sephora failed to:
- Disclose to consumers that it was selling their personal information
- Process user requests to opt out of sale of personal information in accordance with the CCPA
- Cure these violations within the 30-day period currently allowed by the CCPA.
Attorney General Bonta issued a press release saying: "I hope today's settlement sends a strong message to businesses that are still failing to comply with California's consumer privacy law. My office is watching, and we will hold you accountable."
In Sephora's case, Sephora was allowing third-party companies to install tracking software on their website and in their app so that third parties could monitor customers as they shopped. The third-parties were tracking, inter alia, what kind of computer the customer was using, what products/brands the user put in her shopping cart, and the user's location. Sephora was using the information obtained from these third-party trackers to more effectively target potential customers. Sephora's arrangement with these third-party customers constituted a "sale" under the CCPA, which required Sephora to allow customers to opt-out of such information-sharing.
Under the settlement agreement, Sephora agreed to:
- Pay $1.2 million
- Expressly disclose that it sells data
- Provide opt-outs for the sale of personal information, including via the Global Privacy Control
- Conform its service provider agreements to the CCPA's requirements; and
- Report to the AG on its sales of personal information, the status of its service provider relationships, and its efforts to honor Global Privacy Control
For more information on the Sephora settlement agreement, and on the Attorney General's ongoing enforcement actions with respect to failures to process opt-out requests, please see the AG's Press Release.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.