Sephora is a beauty and cosmetics retailer (in-store and app/web) owned by LVMH Moet Hennessy Louis Vuitton as part of LVMH's 'Selective Retailing' business group. Sephora's own privacy policy discloses collecting standard identifying information plus co-branded loyalty data shared with partner Kohl's, and states its use of pixels, web beacons, SDKs, third-party libraries and cookies -- deployed with advertising networks, analytics providers and social media platforms -- 'may be considered a "sale" / "sharing" under applicable law.' Apple's App Store privacy label confirms the Sephora app links Financial Info, Location, Sensitive Info and other categories to identity and uses Purchases, Search History, Identifiers and Usage Data to track users across other companies' apps and websites. Corporate ownership is traceable via LVMH's own published house page naming Sephora's CEO, founding date, and headquarters. In August 2022, the California Attorney General announced a $1.2 million CCPA settlement with Sephora -- the first CCPA enforcement action -- resolving allegations that Sephora failed to disclose it was selling personal information and failed to honor opt-out requests sent via the Global Privacy Control.
TRACK RECORD
1 ENFORCEMENT ACTION
[2022-08-24]
The California Attorney General's August 24, 2022 press release announced a settlement with Sephora resolving allegations that Sephora failed to disclose it was selling consumers' personal information and failed to process opt-out-of-sale requests sent via the user-enabled Global Privacy Control, in violation of the CCPA -- California's first CCPA enforcement action, resulting in a $1.2 million penalty and injunctive terms.
Apple's App Store privacy label for the Sephora app discloses that data including Financial Info, Location, Contact Info, User Content, Search History, Identifiers, Usage Data, Sensitive Info, and Diagnostics may be collected and linked to the user's identity.
Sephora's privacy policy defines its 'Basic Identifying Information' category as full name, alias, postal address, email address, phone number, date of birth, account name, signature, username, and social media handle -- the core identity data collected across its retail and loyalty programs.
LVMH's own corporate website publishes a dedicated house profile for Sephora within its 'Selective Retailing' business group, naming Sephora's CEO, its 1979 founding date, and its headquarters address in Neuilly-sur-Seine, France.
Sephora's privacy policy self-declares that its use of online tracking technologies may constitute a 'sale' or 'sharing' of personal information under applicable law, and offers a Global Privacy Control-based opt-out; the same policy discloses disclosing Basic Identifying Information to businesses, service providers, and third parties such as advertising networks, analytics, and social media networks.
Have I Been Pwned's breach catalog lists the "Sephora" incident (sephora.com.au), breach date 2017-01-09, affecting approximately 780,073 accounts. Data classes exposed per HIBP: Dates of birth, Email addresses, Ethnicities, Genders, Names, Physical attributes. Source: Have I Been Pwned (haveibeenpwned.com), CC BY 4.0.
The California Attorney General's August 24, 2022 press release announced a settlement with Sephora resolving allegations that Sephora failed to disclose it was selling consumers' personal information and failed to process opt-out-of-sale requests sent via the user-enabled Global Privacy Control, in violation of the CCPA -- California's first CCPA enforcement action, resulting in a $1.2 million penalty and injunctive terms.
Apple's App Store privacy label for the Sephora app discloses that Purchases, Search History, Identifiers, and Usage Data may be used to track the user across apps and websites owned by other companies.
Sephora's privacy policy discloses that Sephora and its third-party advertising network, analytics, and social media partners use pixels, web beacons, software developer kits (SDKs), third-party libraries, and cookies to gather information when users interact with Sephora's sites or emails.