Facts

The People of the State of California brought an action against Sephora USA, Inc., following an investigation into the privacy practices of Sephora for its collection, use, and sale of consumers' online activities and other personal information.

PLAINTIFF'S CONTENTIONS: Plaintiff asserted violations of the California Consumer Privacy Act (CCPA); and the Unfair Competition Law. More specifically, plaintiff contended that defendant failed to disclose to consumers that it was selling their personal information; failed to process user requests to opt out of sale via user-enabled global privacy controls in violation of the CCPA; and that it did not cure these violations within the 30-day period allowed by the CCPA. Plaintiff argued that defendant engaged in unlawful, unfair, or fraudulent acts or practices, which constituted unfair competition within the meaning of the Business and Professions Code. Defendant's acts or practices included making false or misleading statements of facts concerning defendant's sale of consumers' personal information and unfairly depriving consumers of the ability to opt-out of this sale.

DEFENDANT'S CONTENTIONS: Defendant denied all contentions.

Result

The settlement requires defendant to pay $1.2 million in penalties and comply with important injunctive terms. Among other injunctive terms, defendant must clarify its online disclosures and privacy policy to include an affirmative representation that it sells data; and provide mechanisms for consumers to opt out of the sale of personal information.