Sephora Fined $1.2 Million in California AG’s First CCPA Settlement

On August 24, California Attorney General (AG) Rob Bonta announced that the California Office of the Attorney General (OAG) has entered into its first settlement under the California Consumer Privacy Act (CCPA). The settlement, reached with Sephora USA, Inc., requires Sephora to pay $1.2 million and comply with several injunctive terms. According to the OAG’s announcement, its action against Sephora followed an “enforcement sweep” of online retailers conducted by the OAG.

The Sephora settlement suggests that the OAG intends to be more aggressive in the coming months in enforcing the CCPA, and will focus increasingly on businesses that engage in the sharing or selling of personal information to third parties for purposes of targeting advertising. Reminding companies that they no longer will benefit from a 30-day notice and cure period when the California Privacy Rights Act—a law that substantially amended the CCPA—comes into effect, the AG warned: “[i]t’s been more than two years since the CCPA went into effect, and businesses’ right to avoid liability by curing their CCPA violations after they are caught is expiring. There are no more excuses. Follow the law, do right by consumers, and process opt-out requests made via user-enabled global privacy controls.”

To learn more about the settlement and its implications, read this Advisory.