Retail & Fintech · Retail (beauty) · Regulatory action
Sephora (LVMH)
Headline
Sephora's Virtual Artist try-on drew a BIPA suit on the same theory as Ulta's GLAM Lab - facial geometry captured to render a cosmetic preview.
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
Sephora's Virtual Artist try-on drew a BIPA suit on the same theory as Ulta's GLAM Lab - facial geometry captured to render a cosmetic preview. Sephora is separately significant for a different reason worth recording: it paid $1.2 million to settle an August 2022 California Attorney General CCPA enforcement action centred on the AG's allegation that letting third-party companies install tracking software on its website and app to monitor shoppers constituted a 'sale' under the statute even though no money changed hands for the data itself (a settlement, not an adjudicated finding). That reading is why so many privacy policies in this tracker now carefully distinguish 'sale' from 'sharing.'
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
This is one of at least THREE beauty retailers (Sephora, Ulta, Mary Kay) sued over structurally IDENTICAL virtual-try-on facial-scanning technology within the same general timeframe — suggesting this specific AR/beauty-tech category is a genuine industry-wide BIPA risk area, not any single company's isolated choice.
Data sharing
REPORTED BIPA LAWSUIT (case details not re-verified in this review) (over Sephora's 'Virtual Artist' try-on kiosk/tool, developed with a Toronto-based technology vendor, Modiface): the complaint alleges Sephora's Virtual Artist Kiosk extracts customers' FACIAL GEOMETRY to digitally apply cosmetics to their image — the SAME underlying biometric-collection pattern documented for Ulta and Mary Kay in this same research — without adequate BIPA-required consent or disclosure of retention/destruction practices. Sephora and its vendor Modiface are reportedly both named defendants, illustrating (like several other findings in this tracker) how a THIRD-PARTY TECHNOLOGY VENDOR (not just the retailer itself) can be directly implicated in a biometric-privacy claim.
Fees and billing
Not itemized this pass.
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy sephora.com/beauty/california-privacy-notice | Not fetched yet | NO (HTML only) |
| Terms of service sephora.com/beauty/terms-of-use | Not fetched yet | NO (HTML only) |
| Website No URL recorded | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
| Action | Amount | Link |
|---|---|---|
| People v. Sephora USA, Inc. California Attorney General, 2022 Cal. AG Press Release Aug. 24, 2022; Final Judgment & Stipulated Permanent Injunction. | $1.2M | candidate needs review |
Links are proposed matches, not yet reviewed.
State statute
No HQ state on file, so no state statute applies by headquarters.