Sephora settles the first California action over Global Privacy Control

$1.2 million

The Attorney General alleged that third-party trackers on Sephora’s site collected browsing and product-interest data that counted as a sale, that Sephora did not disclose this, and that it ignored Global Privacy Control opt-out signals. Sephora agreed to pay $1.2 million, update its privacy policy to say it sells data, support Global Privacy Control, align its service-provider contracts and report to the Attorney General.

On 24 August 2022, California Attorney General Rob Bonta announced a settlement with Sephora, the beauty retailer, under the California Consumer Privacy Act. It followed an enforcement sweep of online retailers, and it centred on what ran behind Sephora's website and app.

The Attorney General alleged that Sephora let third-party companies run tracking software on its site and app, and that this arrangement amounted to a sale of shoppers' personal information. Those trackers could build profiles from details such as a shopper's computer, the eyeliner in a shopping cart, or a precise location. The Attorney General also alleged that Sephora did not tell shoppers it was selling their information, did not process opt-out requests sent by Global Privacy Control, and did not put these problems right within the 30-day cure period the law then allowed.

Sephora agreed to pay $1.2 million. Under the settlement it must state clearly in its disclosures and privacy policy that it sells data, give people ways to opt out of that sale, including through Global Privacy Control, bring its service provider agreements into line with the Act, and report to the Attorney General on its data sales, service providers and handling of Global Privacy Control.

None of this involved a hacker or a leaked database. It came down to ordinary tags on an ordinary shopping site, and to a browser signal that, by the Attorney General's account, went unanswered. Global Privacy Control lets a shopper send a "do not sell" request to every site they visit at once, and the announcement said businesses must treat that signal the same as a click on their own opt-out link.

Sephora is not the only case on this theme. In March 2026, California's privacy agency ordered Ford to pay $375,703, saying it made people verify their email address before acting on an opt-out, and requiring it to honour opt-out preference signals, including Global Privacy Control.

For any website, the questions are the same. Which third-party tags load when a shopper arrives? What do they collect? Does the privacy policy describe that plainly? And when a browser sends Global Privacy Control, do those tags actually stop?

Why it matters for your siteHonouring a browser opt-out signal is checked, not assumed.

The transcript

One point two million dollars. That's what Sephora agreed to pay California's Attorney General, in a settlement announced in August 2022. The case was about the beauty retailer's website and app.

So what was it accused of? The Attorney General alleged that other companies' tracking software on Sephora's site and app amounted to selling shoppers' personal information. And that Sephora never told shoppers it was selling it.

Those trackers could profile shoppers: a MacBook or a Dell, the eyeliner in a shopping cart, even a precise location. The Attorney General also alleged that Sephora ignored Global Privacy Control, the browser signal that says do not sell, and didn't fix it in the thirty days then allowed.

And what did it pay? One point two million dollars, in a settlement. Sephora must also say plainly that it sells data, let shoppers opt out, including through Global Privacy Control, update its service provider contracts, and report back to the Attorney General.

Notice what this was not. No hacker. No leaked database. Just ordinary tracking tags on a shop's website, and a browser signal that went unanswered.

And it's not alone. Since then, in 2026, California's privacy agency ordered Ford to pay more than three hundred and seventy-five thousand dollars, saying it made people verify their email before acting on an opt-out. Ford must now honour Global Privacy Control.

Regulators now look for exactly that gap: between the choice a brand says it gives its shoppers, and what its website actually does. Most brands can't say which tags run on their site, or whether they stop when the browser asks them to.

That's what Tolbrook checks. We go through your site the way a shopper would, and show you what we find, with the evidence.

Find it. Fix it. Watch it.

Opt-out signalsSource: California Attorney General

Each summary is ours, drawn from the public announcement it links to. Allegations are the regulator’s own, and a settlement usually comes without any admission. This page reports what was announced. It is not legal advice, and it says nothing about any site we audit.

Find these problems before anyone else does

The digital compliance problems behind actions like these are the ones we look for. We find them on your site and show you exactly where each one sits.

Order a report

All news