California v. Sephora USA, Inc.

Beauty retailer Sephora USA, Inc. (Sephora) (defendant) sold products to consumers via its website and mobile application as well as in stores. Sephora allowed third-party businesses to install software on its website and mobile app that gave the businesses access to information about consumers’ purchases and viewed products, physical location, technical information, and more. In exchange, the businesses provided Sephora with analytics and targeted-advertising opportunities. Neither Sephora’s website nor its mobile app informed consumers of the personal information being collected and sold to third parties. In fact, Sephora’s website stated that Sephora did not sell consumers’ personal information. Additionally, Sephora did not have a link allowing consumers to opt out of the sale of their personal information. Sephora also sold consumer data even if consumers had universally opted out of the sale of their personal information using a global privacy control (GPC). After a large-scale investigation into retailers’ practices, California’s attorney general (plaintiff) informed Sephora that it was violating the California Consumer Privacy Act of 2018 (CCPA) by failing to (1) notify consumers of information being sold, (2) provide an opt-out link, and (3) honor consumers’ GPCs. When Sephora failed to remedy its noncompliance, the attorney general filed suit to enforce the CCPA. After negotiations, the parties stipulated to the entry of a final judgment with agreed terms.