First California Privacy Penalty Flags Consumer Data Sales Peril

California’s $1.2 million penalty against Sephora for breaching the state’s landmark consumer data privacy law signals ramped-up regulatory scrutiny of the sale of personal information.

A settlement announced Aug. 24 is the first public enforcement action that Attorney General Rob Bonta (D) has brought under the California Consumer Privacy Act. The deal may offer a hint of what’s in store for companies that run afoul of the law, as regulators at California’s privacy agency write rules for complying with updates to it.

“This is a case that a lot of companies have been waiting for” to get a sense of ...