Retailers Scramble to Ensure Targeted Ads Comply With New Privacy Regs

Retailers are reportedly racing to comply with California’s data privacy regulations as a new, stricter law is set to take effect in the state beginning Jan. 1. 

The new California Privacy Rights Act (CPRA) expands upon the existing California Consumer Privacy Act (CCPA), which has been law since 2020, and comes with the elimination of a 30-day “cure period” that is currently allowed to businesses that are accused of violations, The Wall Street Journal reported Tuesday (Sept. 27). 

Retailers, including direct-to-consumer (D2C) businesses that rely on targeted ads, are also sharpening their focus on the current regulations under CCPA after a Sephora settlement that totaled $1.2 million regarding its targeted advertising practices that allegedly violated the law, according to the report. 

California Attorney General Rob Bonta said Aug. 24 in a press release that Sephora violated the CCPA by selling consumers’ personal information without disclosing that it was doing so and failing to process users’ requests via privacy controls to opt out. 

“I hope today’s settlement sends a strong message to businesses that are still failing to comply with California’s consumer privacy law,” Bonta said in the release. “My office is watching, and we will hold you accountable.” 

PYMNTS has reached out to Sephora for comment. 

As PYMNTS reported in June, some 90% of U.S. companies are not prepared to meet the requirements of California data privacy and protection laws that are expected to go into full effect on Jan. 1. 

Read more: The Future of Digital Identity Verification: Driven by Technology, Shaped by Regulators 

The CCPA and CPRA require that companies doing business with residents of the state comply with regulations giving these consumers more control over how their data is collected and used, according to the “Alternative Payments Tracker®,” a PYMNTS and Socure collaboration. 

Laws similar to California’s CCPA will take effect in four more states — Colorado, Connecticut, Utah and Virginia — next year, The Wall Street Journal report stated.