The complaint filed by the AG’s Office alleged that Sephora violated the CCPA by, among other things:
- Failing to disclose to consumers that it was selling their personal information.
- Affirmatively stating that it did not sell consumers’ information when it fact it did have business relationships with third-parties to serve targeted ads based on a consumers’ browsing history.
- Failing to provide a conspicuous “Do Not Sell My Personal Information” link in either its app or website.
The Complaint further notes that Sephora was given 30 days’ notice to cure its alleged violations and failed to do so.
The AG’s press release underscores the AG’s focus on large companies’ compliance with the CCPA. It further notes that the AG’s Office conducted a sweep to determine whether Global Privacy Control signals—which allow consumers to broadcast a “do not sell” signal across every website they visit without clicking a Do Not Sell link—were adequately received and respected by online retailers. According to the AG, Sephora “wholly disregarded” consumers who communicated that Sephora should not sell their personal information.
Sephora does not admit or deny any fault, wrongdoing or violation in the judgment. However, in addition to the $1.2 million penalty and commitment to the CCPA and forthcoming CPRA amendments, Sephora must specifically:
- Provide notice to consumers if it sells their personal information, and give consumers the right to opt-out.
- Process requests signaled by the Global Privacy Control.
- Implement and maintain a program to assess and monitor whether it is effectively processing requests and, for a period of two years, report its compliance to the AG.
The AG further noted that his office notified more businesses on Wednesday that they were not compliant with the CCPA’s opt-out requirements. While the AG is currently required to give businesses the statutory 30 days’ right to cure, on January 1, 2023, the AG’s notice-and-cure period becomes discretionary.
The press release also noted that the AG has included new examples of notices of non-compliance that have been sent to businesses, available here, and include CCPA compliance issues such as:
- Loyalty programs that offered financial incentives such as discounts, free items, or other rewards, in exchange for personal information without providing consumers with a notice of financial incentive.
- Privacy disclosures that were not understandable to the average consumer and did not include the required information.
- A “Do Not Sell My Personal Information” link that worked only on certain browsers and directed consumers to a confusing webpage that required several additional steps to submit CCPA requests.
Takeaways
- The AG is focused on data tracking and third-party agreements. Businesses need to carefully assess and disclose whether they are “selling” consumer information. Conforming service provider agreements to the CCPA’s requirements could assist with minimizing sales of personal information.
- Businesses must allow customers to opt-out of data sharing. The Complaint shows that the AG views the CCPA’s compliance requirements as straight-forward, and promises further enforcement for those businesses who continue to ignore the statutory mandate.
- It is uncertain whether the AG will continue to provide a 30-day cure period to businesses when they fail to comply. The CPRA brings many changes, including making the cure period discretionary to the AG, and businesses must evaluate their CPRA compliance now to ensure that they are not caught unaware come 2023.
