California AG fines Sephora $1.2M for ignoring opt-out signals

In August 2022, California Attorney General Rob Bonta announced a $1.2 million settlement with Sephora, the first public settlement under the CCPA. The state alleged Sephora sold consumers' personal information, including data on shopping habits gathered through tracking software embedded in its website and app, to advertising and analytics companies without disclosing the sale or offering a way to opt out, and did not honor opt-out requests sent through user-enabled Global Privacy Control signals. Under the settlement, Sephora must update its privacy disclosures to clearly state it sells data, add functioning opt-out mechanisms including GPC support, bring its contracts with third-party vendors in line with the CCPA's service-provider requirements, and report on compliance for two years. The AG's office paired the announcement with a reminder to other businesses that not honoring GPC is treated as a sale opt-out violation.