United States · Privacy · 24 Aug 2022

Sephora pays $1.2m for selling shopper data and ignoring browser opt-out signals

$1.2 million plus compliance changes and reporting

Company: Sephora
Regulator or court: California Attorney General
Law: California Consumer Privacy Act (CCPA)
Status: Settlement

What happened

The Attorney General said Sephora let third-party tracking tools on its website collect shopper data, which counted as 'selling' personal information under California law, without telling customers. Sephora also ignored the Global Privacy Control, a browser setting that tells websites not to sell a user's data. It did not fix the problems within the 30-day cure period it was given, and became the first CCPA case to end in a fine.

Sources

California AG press release Hunton Andrews Kurth – first CCPA enforcement settlement

Summary in our own words. General information, not legal advice.

Ready when you are

Could this happen to you? Let’s find out.

Tell me what you’re building. I’ll tell you what you need. No obligation.

Book an intro call

What happened

Marketing firms pay $930,000 over fake AI 'listening' ad service

Coupang hit with Korea's biggest ever privacy fine after insider data leak

GM pays record $12.75m for selling drivers' location and driving data

Could this happen to you? Let’s find out.