Run a free scan

Sephora: check whether your system acts on opt-out signals

You can trace an opt-out from the browser to each data transfer. California’s 2022 Sephora settlement shows why that path matters.

California DOJ · CCPA · Settlement announced 24 August 2022

Case record

Sephora enforcement facts
FactRecord
AuthorityCalifornia Department of Justice
Jurisdiction and lawCalifornia, US · California Consumer Privacy Act (CCPA)
ActionStipulated judgment to resolve allegations
Announced24 August 2022
Judgment filed24 August 2022
AmountUSD 1.2 million in civil penalties
Source review16 October 2026

DOJ announcement · Filed judgment, pages 1–2. Sephora and the California Department of Justice (DOJ) agreed to a stipulated judgment. The court did not hold a trial or adjudicate fact or law.

Sephora did not admit liability.

What happened

The Attorney General alleged that Sephora did not disclose sales of personal information. The complaint also alleged that Sephora failed to process Global Privacy Control (GPC) opt-outs.

The DOJ said that Sephora did not correct the alleged violations within the 30-day cure period that applied then. Sephora and the DOJ settled the action. DOJ announcement

The settlement set USD 1.2 million in civil penalties. It also called for clearer sales disclosures and opt-out controls that process GPC.

Other terms covered service-provider agreements under the CCPA and reports to the Attorney General. The remedies covered contracts and operations as well as the interface. DOJ announcement

Technical behaviour

The complaint alleged that the site did not detect or process GPC signals. It also described third-party trackers that sent activity in the shop and other personal information to companies for ads and analytics. These are allegations in a complaint, not findings from a trial. Complaint, paragraphs 5 and 10–12

Inth’s technical interpretation: a system must act on the opt-out after it detects the signal. The signal must reach each control that decides whether to send data. A changed toggle does not show what data left the system.

GET /example-product HTTP/1.1
Host: shop.example
Sec-GPC: 1

This example uses an invented domain. It does not reproduce Sephora’s code or traffic. The GPC specification defines the signal.

The header alone does not show whether later systems respect the choice.

Checks for your own systems

In the repository

  • Find where the application receives opt-out signals.
  • Trace each signal to the decision about each data use.
  • Follow that decision through the tag manager, event queues, and server integrations.
  • Find default rules or other paths that bypass the decision.

In the browser and network

  • Use a browser that sends GPC.
  • Compare fresh sessions with GPC on and off.
  • Record the region, login state, and previous choices.
  • Check network requests, data payloads, and storage on the first page load.
  • Repeat the check after navigation and a manual opt-out.

With the people responsible for data use

  • Compare the observed destinations with the vendor list, stated purposes, disclosures, and signed contracts.
  • Agree which data flows must stop or change.
  • Check the server operations that a browser capture cannot show.

Sources and limits

Source review: 16 October 2026. This page describes the cited 2022 action. It does not audit Sephora’s current systems.

This review does not establish the status of every later legal action. Inth wrote the checks. The regulator did not prescribe them.