First Major CCPA Violation Enforcement Action Announced!

In an age where many businesses regularly share consumer personal information, the California Attorney General sent a clear message to industry by announcing its first major enforcement action for violations of the California Consumer Privacy Act ("CCPA"). Passed in 2018, the CCPA went into effect on January 1, 2022, with the aim of giving consumers "more control" over their personal information collected online. On August 24, 2022, the California AG announced a landmark settlement in which Sephora USA, Inc., a retailer of personal care and beauty products, was required to pay $1.2 million in penalties and make specific changes to the way in which it tracks and uses consumer data. Under the CCPA, businesses have 30 days to cure alleged violations, after which they are subject to enforcement action. Perhaps due to the perceived unlikelihood of enforcement actually taking place, Sephora failed to comply. Consequently, the AG appears to have decided to make an example of