On August 24, 2022, the Superior Court of the State of California for the County of San Francisco (the Court) approved a settlement between the Attorney General of California (AG) and Sephora USA, Inc. (Sephora) relating to violations of the California Consumer Privacy Act (the CCPA).  The settlement requires Sephora to pay $1.2 million in penalties and comply with certain injunctive terms.  

In its complaint, the AG alleged that Sephora arranged for a third-party company to install tracking software on the Sephora website and app in order for third parties to monitor consumers as they shopped, and track data, including whether the consumer was using a MacBook or a Dell, and the brand of eyeliner that a consumer put in their shopping cart.  The AG claimed that the arrangement was considered a sale of personal information under the CPPA, and as a result Sephora was required to fulfil its obligations, including informing consumers that they were selling their information and allowing consumers to opt out of such sale.  Sephora did not complete either requirement. 

Sephora was alleged to have, contrary to the CCPA, failed to: (i) disclose to consumers that it was selling their personal information; (ii) process consumer requests to opt out of sale via user-enabled privacy controls; and (ii) cure the violations within 30 days.

In addition to the financial penalty, the settlement requires Sephora to provide notice to consumers explicitly stating that it sells their personal information and that consumers have the right to opt out of all sales; to process consumer requests to opt out via the Global Privacy Control; and to provide annual reports to the AG that assess Sephora’s progress in monitoring and processing consumer requests to opt out of the sale of personal information.

Summary By: Sharan Johal

E-TIPS® ISSUE

22 09 07

Disclaimer: This Newsletter is intended to provide readers with general information on legal developments in the areas of e-commerce, information technology and intellectual property. It is not intended to be a complete statement of the law, nor is it intended to provide legal advice. No person should act or rely upon the information contained in this newsletter without seeking legal advice.

E-TIPS is a registered trade-mark of Deeth Williams Wall LLP.