On August 24, 2022, California Attorney General Rob Bonta announced the Office of the Attorney General’s (“OAG’s”) first settlement of a California Consumer Privacy Act (“CCPA”) enforcement action, against Sephora, Inc.

The OAG’s enforcement action against Sephora, which was part of a broader “enforcement sweep” of over 100 online retailers, involved allegations that Sephora failed to:

• Disclose to consumers that the company “sells” personal information (as broadly defined under the CCPA);

• Provide a “Do Not Sell My Personal Information” link;

• Provide two or more methods to opt out of sale;

• Process opt-out of sale requests via user-enabled global privacy controls (such as the Global Privacy Control); and

• Cure these alleged violations within the 30-day cure period currently guaranteed under the CCPA.

The OAG alleged that Sephora not only violated the CCPA, but also violated California’s Unfair Competition law, by engaging in “unlawful, unfair, or fraudulent acts or practices, which constitute unfair competition,” including making false or misleading statements about Sephora’s sale of consumer’s personal information and “unfairly depriving” consumers of the ability to opt out of sale.

In its complaint, the OAG alleged that Sephora allowed third parties to install tracking software (e.g., cookies, pixels, SDKs) on its website and app to enable the third parties to monitor consumers’ online behavior as they shop. The OAG alleged that these third parties collected various types of personal information about consumers through their tracking technologies, including the products a consumer views and purchases, a consumer’s precise geolocation, cookies and other user identifiers, and technical information about a consumer’s device, operating system and browser type.  The OAG alleged that certain of these third parties used this data to create “entire profiles of users” who visited Sephora’s website, which the third parties then used for Sephora’s benefit (e.g., in the form of detailed analytics and targeted advertising), and for the benefit of other businesses, “without the knowledge or consent of the consumer.” Notably, the complaint alleged that because Sephora’s website offers for sale prenatal and menopause support vitamins, third parties can use this data to infer conclusions about women’s health conditions, thereby “depriving consumers of the ability to limit the proliferation of their data on the web.”

The OAG made clear that Sephora’s disclosure of consumer personal information to third parties in this context constitutes a “sale” under the CCPA’s broad definition of the term (i.e., the disclosure of personal information to a third party “for monetary or other valuable consideration”), stating that “[r]etailers like Sephora benefit in kind from these arrangements, which allow them to more effectively target potential customers.” Additionally, the OAG’s settlement with Sephora makes explicit that the “other valuable consideration” Sephora received in exchange for sharing its consumers’ data with such third parties included “personal information or other information such as analytics, and free or discounted services.”

Under the settlement, Sephora must:

• Pay $1.2 million in penalties;

• Affirmatively represent in its online disclosures and privacy policy that the company sells personal information;

• Provide mechanisms for consumers to opt out of the sale of personal information, including via the Global Privacy Control;

• Conform its service provider agreements to the CCPA’s requirements; and

• Provide reports to the OAG regarding Sephora’s sale of personal information, the status of its service provider relationships, and its efforts to honor the Global Privacy Control.

This enforcement action makes clear that sharing personal information with “third parties” (i.e., non-“service providers”) for targeted advertising or analytics purposes constitutes a “sale” under the CCPA, for which businesses must offer consumers an opt-out opportunity. It also indicates that the OAG is serious about enforcing businesses’ compliance with the Global Privacy Control.