Skip to main contentSephora
$1.2m
California DOJ · California, US ·
Ignored opt-out signals
Find privacy failures you can check in your own systems
You can compare 5 cases in one place. Each case links the regulator’s account to technical behaviour and checks for your own systems.
Honda
$633k
CPPA · California, US ·
Unequal choices or identity checks
Todd Snyder
$345k
CPPA · California, US ·
Unequal choices or identity checks · Failed opt-out controls
Healthline
$1.55m
California DOJ · California, US ·
Failed opt-out controls · Sensitive context in event data
SHEIN
€150m
CNIL · France ·
Cookies before choice or after refusal
- €150m · $3.73m
- 5
- 5
- 2022–2025
SHEIN
CNIL found that the site placed cookies before consent. It also found cookie reads or writes after refusal or withdrawal.
Cookies before choice or after refusal
France · French Data Protection Act, Article 82
Healthline
The California DOJ alleged that opt-outs failed. It also alleged that disclosed data could suggest a prior medical diagnosis.
Failed opt-out controls · Sensitive context in event data
California, US · CCPA
Todd Snyder
The CPPA alleged that the privacy portal failed to process opt-out requests for 40 days.
Unequal choices or identity checks · Failed opt-out controls
California, US · CCPA
Honda
The CPPA challenged unequal choices and unnecessary identity checks in Honda’s privacy process.
Unequal choices or identity checks
California, US · CCPA
Sephora
The California DOJ alleged that Sephora ignored Global Privacy Control (GPC) opt-outs. It also alleged that Sephora did not disclose sales of personal information.
Ignored opt-out signals
California, US · CCPA