## Facts

- The California Attorney General brought a civil enforcement action against Sephora USA, Inc., a retailer operating a website and mobile application that used third-party tracking technologies (e.g., cookies, pixels, SDKs).
- The Attorney General alleged Sephora enabled third parties to receive consumer information associated with online activity and purchases (including device details, shopping-cart contents, and location data).
- Sephora allegedly received analytics and advertising-related benefits in exchange for making consumer personal information available to these third parties.
- The Attorney General treated these arrangements as a “sale” of personal information under the California Consumer Privacy Act (CCPA).
- Sephora allegedly stated on its website that it did not sell personal information, failed to provide a “Do Not Sell My Personal Information” link and required opt-out methods, and did not process Global Privacy Control (GPC) opt-out signals.
- After a statutory notice and opportunity to cure, the Attorney General alleged Sephora did not cure within the CCPA’s then-available 30-day period.
- The complaint also asserted a claim under California’s Unfair Competition Law (UCL) based on alleged false or misleading statements and deprivation of opt-out rights.
- The case resolved through a stipulated judgment and permanent injunction rather than a contested merits decision.

## Issues

1. Whether providing consumer personal information to third-party analytics and advertising providers in exchange for related benefits constitutes a “sale” under the CCPA.
2. Whether a business engaging in such “sales” must disclose that practice and provide compliant opt-out mechanisms, including a “Do Not Sell My Personal Information” link and multiple opt-out submission methods.
3. Whether failing to detect and treat GPC signals as opt-out requests violates the CCPA’s opt-out requirements.
4. Whether representing that personal information is not sold, while allegedly engaging in sales and limiting opt-out rights, constitutes unlawful, unfair, or fraudulent conduct under the UCL.

## Decision

- The parties entered a stipulated judgment and permanent injunction resolving the Attorney General’s CCPA and UCL claims without a judicial ruling on the merits.
- Sephora agreed to pay $1.2 million in civil penalties.
- Sephora agreed to revise disclosures and its privacy policy to state affirmatively that it sells personal information.
- Sephora agreed to provide mechanisms to opt out of the sale of personal information, including recognizing opt-out requests sent via GPC.
- Sephora agreed to bring relevant vendor relationships into CCPA-compliant “service provider” form through contract changes.
- Sephora agreed to provide compliance-related reporting to the Attorney General concerning sales, vendor relationships, and GPC processing.

## Legal Principles

- Under the CCPA, a “sale” may include making personal information available to third parties in exchange for non-monetary benefits (e.g., analytics or advertising advantages), not only cash transactions.
- If personal information is sold, the business must disclose that fact and provide meaningful opt-out rights, including a “Do Not Sell My Personal Information” mechanism and required submission methods.
- User-enabled global privacy controls (including GPC) function as opt-out requests that must be detected and honored through technical implementation, not only policy statements.
- Inaccurate public statements about whether personal information is sold, coupled with practices that limit opt-out rights, can support enforcement under the UCL.

## Conclusion

The stipulated judgment imposed civil penalties and injunctive compliance obligations based on the Attorney General’s theory that third-party tracking for analytics and advertising benefits can be treated as a CCPA “sale,” requiring accurate disclosures, operational opt-out mechanisms including GPC recognition, and compliant service-provider contracting.


People v. Sephora USA, Inc., No. CGC-22-601380 (Cal. Super. Ct. 2022)