Cosmetics giant Sephora to pay California $1.2 million in consumer privacy settlement

Sephora, one of the largest cosmetic retailers in the world, has agreed to pay the state of California $1.2 million in penalties.

Attorney General Rob Bonta made the announcement Wednesday, and said the settlement resolves allegations that the company illegally sold consumer data. 

“Sephora failed to disclose to consumers that it was selling their personal information by making this information available online to third party trackers in exchange for benefits like targeted advertising and discounted analytics,” Bonta said.

The Attorney General’s Office said Sephora also did not allow customers to opt out of the sale of their personal information, and failed to fix the problem within 30 days, the time period allowed by law. 

It's the first significant settlement under the state's recently enacted California Consumer Privacy Act, or CCPA, which is intended to give consumers more control over the personal information businesses collect about them. It’s the first law in the U.S. regulating data privacy. 

Though it was signed into law in 2018 by then-Governor Jerry Brown, the CCPA went into effect on January 1, 2020. Its protections were expanded after voters passed Proposition 24 in 2020.

All companies which serve California residents and make at least $25 million in annual revenue must comply with the CCPA’s regulations. 

In addition to the penalty fees, the California Attorney General’s Office says Sephora agreed to tell customers about the potential for their personal information to be sold.

Sephora will also be required to provide Bonta’s office reports about its sale of customers’ personal data, among other privacy practices.

Bonta announced Wednesday that his office has sent notices to a handful of other businesses at risk of violating consumer opt-out request requirements set by the CCPA. Businesses who received letters must fix their alleged violations within 30 days.