CCPA In the News - Sephora Fined $1.2 Million in California AG's First CCPA Settlement

1. 1
1
CCPA in the News
• On August 24, the Office of the Attorney General (OAG) first settlement under the
CCPA, alleging that Sephora failed to:
○ Disclose to consumers that it was selling their personal information
○ Process user requests to opt out of sale requests via user-enabled global
privacy controls
○ Provide a clear and conspicuous “Do Not Sell My Personal Information” link
enabling consumers to opt -out of the sale of their personal information; and
○ Provide two or more designated methods for submitting requests to opt -out.
• The OAG also alleged Sephora violated California’s Unfair Competition Law by
“making false or misleading statements of facts concerning Defendants’ sale of
consumers’ personal information and unfairly depriving consumers of the ability to
opt-out of this sale.”
Sephora Fined $1.2 Million in California AG’s First CCPA Settlement

2. 2
CCPA in the News
● Sephora installed third-party software on its website and app to track online
consumer activity - the OAG notably called it “commercial surveillance.”
● The OAG asserted the software could track all types of data and could build behavioral
profiles of users, allowing Sephora to more effectively target potential customers.
○ By receiving this data, Sephora engaged in selling - benefitting from “other
valuable consideration” in the CCPA’s definition of “sale”.
● The OAG also asserted there were no valid service-provider contracts in place, which is
one exception to “sale” – contractually limiting the third-party tracking companies to
processing requirements to establish them as “service providers” under the CCPA.
● What’s next? CPRA may provide more risk to online tracking activities – bringing the
right to opt out of the sale of personal information AND of the transfer of personal
information to a third party for cross-context behavioral advertising.
What Happened?