What Sephora does with your data

What it collects and does with your data

• The former head of Sephora's media network told The Drum he grew it to more than $200M in revenue within two and a half years, about 3% of the retailer's sales. A former executive's statement, not a company filing; year approximate.
• Privacy policy discloses 'sale'/'sharing' of identifiers, device IDs, network activity, geolocation, and commercial data to advertisers and marketing partners, data analytics providers, and social media networks.
• Policy lists physical characteristics (skin tone and type, hair, eye color), health and medical information (skin conditions, medications) provided for services and in-store digital experiences, and demographic data including race, ethnicity, and estimated income.
• Policy says Sephora receives Beauty Insider data from Kohl's (Sephora at Kohl's), and data from Instacart and the Sephora credit card issuer.
• If a user is not logged in, an opt-out of sale/sharing is linked only to the browser identifier; GPC must be enabled in each browser.

Sensitive data

• health (skin conditions, medications)
• physical characteristics
• race/ethnicity and estimated income
• precise location (if enabled)
• payment
• biometrics (historical kiosk face scans, per the 2018 to 2020 BIPA case)

Enforcement and litigation

2 matters in the research. Where the research says alleged, pending, or settled without admitting wrongdoing, so does this page.

• California AG CCPA settlement: AG alleged Sephora sold personal information through third-party trackers without disclosure, lacked a clear opt-out, and did not honor Global Privacy Control. $1.2M penalty plus injunctive terms. Settled. Amount: $1.2 million.
• Salkauskaite v. Sephora USA (N.D. Ill.): BIPA class action over in-store Virtual Artist kiosk facial-geometry scans. Class settlement reached December 2020 (claimants up to $500 each); ModiFace dismissed for lack of jurisdiction.

Who else holds your data

Organizations holding a copy of your data, as the research counts them: at least 6. Floor: Sephora, parent company (LVMH), Kohl's, Instacart, card issuer, Google. Advertisers, analytics firms, and social networks in the sale/share categories are not named.

Third parties: 3 disclosed recipient categories. Named: Kohl's, Instacart, credit card issuer, parent company, Google Analytics. 3 = sale/share recipient categories. The specific list is available only by emailing a request.

Data brokers linked to Sephora

None. The research documents no flow between Sephora and a data broker.

Data practices score

10 of 15. Five components, each 0 to 3. How the score works

Sells or shares

3

Enforcement

2

Retail media scale

2

Sensitive data

2

Opt-out friction

1

Estimated emissions for one person

Research gaps

• Media network revenue is a former executive's statement; no company figure.
• Email frequency is the beauty-category average, not Sephora-specific.
• Exact BIPA settlement amount not verified.