California Attorney General Bonta announced that Sephora, the cosmetic retailer, has agreed to pay $1.2 million to settle allegations that the company failed to comply with the California Consumer Privacy Act of 2018 (“CCPA”).

The Attorney General’s complaint asserts that Sephora failed to inform consumers that it was selling their personal information to third parties. Sephora also purportedly failed to process consumer requests to opt out of Sephora’s sale of their personal information. Specifically, the complaint alleges that Sephora neglected to honor opt-out requests that were submitted to Sephora via a privacy tool called a Global Privacy Control, which is a third-party browser-setting that automatically opts the consumer out of the sale of personal information on each website that the consumer visits.

Since Sephora sold consumers’ personal information to third parties, the company was obligated to alert consumers of its practices and to offer an opt-out option. Per the CCPA, the Attorney General provided Sephora with 30-days’ notice to cure its violations. However, Sephora failed to act within the statutory period.

As a result, Sephora agreed to a settlement with the California Attorney General wherein it will not only pay a $1.2 million fine, but it will: 1) update its online disclosures and privacy policy; 2) provide appropriate consumer opt-out options on its website; 3) modify its service provider agreements to comply with the CCPA standard; and 4) submit reports to the Attorney General regarding Sephora’s sales of personal information.

The Sephora case demonstrates that companies interacting with consumers in California must understand and comply with the requirements of the CCPA or risk significant monetary penalties for noncompliance. It’s important to dial-in CCPA compliance now, because on January 1, 2023, the CCPA will be amended by the California Privacy Rights Act, which will no longer include a 30-day opportunity to cure violations and stave off penalties.

Questions? Feel free to contact the attorneys at SKJ.

© 2010-2024 Strike Kerr & Johns, Beverage Law Group LLP, Alcoholic Beverage Attorneys