Cosmetics giant Sephora settles customer data privacy suit

SACRAMENTO, Calif. (AP) — Sephora Inc., one of the world’s largest cosmetics retailers, has settled a lawsuit claiming that the company sold customer information without proper notice in violation of the California’s landmark consumer privacy law, state Attorney General Rob Bonta said Wednesday.

Sephora failed to tell customers that it was selling their personal information, failed to allow customers to opt out of that sale, and didn’t fix the problem within 30 days as required by the law even after it was notified of the violation, state officials said.

The company agreed to pay $1.2 million and immediately correct the problem under the settlement, the state's first such enforcement action under the California Consumer Privacy Act, according to Bonta.

“Data is power and these days everyone wants it,” Bonta said.

“Some of the most intimate details about your life are being harvested," he said. "The more data a company has on you, the more power they have over you, the more they can target you to buy their goods and services.”

But the state law gives consumers a way to block that collection and sale.

The act was passed by state lawmakers in 2018 and expanded by voters in 2020. It gives California, home to Silicon Valley, what is viewed as the strongest U.S. data privacy law, providing consumers with the right to know what information companies collect about them online, to get that data deleted and to opt out of the sale of their personal information.

Bonta's office has warned more than 100 companies that they were out of compliance and sent more than a dozen new notices on Wednesday. The “vast majority” complied, he said, but not Sephora, which sells cosmetics, perfumes, beauty and skincare products in 2,700 stores in 35 countries.

“Their actions compared to others...