Settlement · 24 August 2022
People v. Sephora USA, Inc. (CCPA)
California Attorney General settlement, 24 August 2022 · California Attorney General
What it means for your code
Honour the Sec-GPC header / navigator.globalPrivacyControl and disclose third-party tracking as 'sale or sharing' in California.
What happened
Sephora let third-party trackers on its site collect shoppers' data in exchange for analytics and advertising benefits, did not disclose this as a sale, and ignored Global Privacy Control signals.
What was decided
Exchanging personal data with ad-tech vendors for services can be a 'sale' under the CCPA, requiring notice and a working opt-out, and Global Privacy Control must be honoured as an opt-out.
⚖ USD 1.2 million
The legal test applied
- Exchanging personal data with third-party trackers for analytics or advertising benefits can be a 'sale' under the CCPA
- Global Privacy Control signals must be honoured as opt-out requests
What would have changed the outcome
- Vendors bound by CCPA-compliant service-provider contracts
Summary and analysis by Lawpatch, checked by an editor against the source. Risk analysis, not legal advice; the law may have moved on since this decision.