First, @Sephora is a strategic choice. The most significant outcome is their 2-yr agreement to honor Global Privacy Control (GPC) signals. It's very important for the AG to get this on the books, because it bolsters CCPA's key (only) redeeming feature: the universal opt-out. 2/
Despite CCPA's underlying weaknesses (advocates have rightly criticized it as an ineffectual notice & choice law), the concept of a decentralized "universal opt-out" browser mechanism has taken hold in the US and been adopted in CO, CT - with great promise. 3/
...
This suggests to me that cleaning up U.S.-facing websites/apps for integrations (analytics, ad partners, location SDKs etc) simply hasn't been a high priority, but was a relatively straightforward thing to do without threatening revenue; 6/
...
All this means that settling is the reasonable path forward, while giving @AGBonta a huge win with a settlement that reflects their position that honoring #GPC is required in all cases. 8/
[
add
]
[
|
|
...
]