Connecticut Attorney General William Tong sent a letter to Sephora regarding the marketing of anti-aging skincare products with harmful ingredients like retinol and acids to children and teens on social media. The AG seeks information on product placements in searches for kids and warning practices, cautioning parents about potential skin harm from these products.
In-house legal teams should review all agreements governing marketing, sales, and platform operations, including influencer marketing agreements, website terms of use, vendor agreements with brands (e.g., Drunk Elephant, Glow Recipe), and any data processing agreements if customer data is involved. Specific clauses to scrutinize are those related to marketing compliance, target audience restrictions, age-gating mechanisms, product warning and disclaimer obligations, and control over search result algorithms and product placements. Given the AG's concern over products appearing in searches for 'kids' and 'gifts for children,' contracts may need amendments to mandate stricter age verification, require prominent warnings about ingredients like retinol and acids for young users, restrict product categorization and search indexing for minor audiences, and impose obligations on influencers to include safety disclaimers when promoting such products to younger demographics.
Entity
Sephora
Industry
RetailOfficial Press Release
https://portal.ct.gov/ag/press-releases/2024-press-releases/attorney-general-tong-cautions-parents-regarding-anti-aging-skincare
sephora usa inc inquiry letter112524.pdf?rev=00d5d4e2d528481
https://portal.ct.gov/-/media/ag/press_releases/2024/sephora-usa-inc-inquiry-letter112524.pdf?rev=00d5d4e2d5284811b6cb15fb6f77f3bb&hash=588DD9C5BED120D3E887339C75E9F0C2
Connecticut Attorney General Enforcement Page
https://portal.ct.gov/AG/Privacy/Privacy-Resources
Connecticut Attorney General William Tong announced a settlement with beauty retailer Sephora resolving an investigation into the company’s marketing of anti-aging skincare products containing active ingredients like retinol to children under 13. Sephora agreed to adopt enforceable safeguards including requiring suppliers to provide age suitability warnings, disclosing those warnings on product pages, training employees to advise young customers, and maintaining a public resource on age-appropriate products. No monetary penalty was imposed.
$500K
Connecticut Attorney General William Tong announced settlements with SunRun, Inc., Elevate Solar Solutions, and two salespeople over allegations of deceptive solar sales, including impersonating consumers and locking homeowners into long-term contracts without consent. SunRun must pay $300,000 and provide consumer relief; Elevate and the salespeople face a stated $200,000 penalty, with $100,000 suspended subject to ongoing compliance.
$8.0M
Connecticut announced an $8 million settlement with Mylan over allegations that it used agreements to delay generic EpiPen competitors and took other actions that inflated prices. Mylan also agreed to provide 10,000 free EpiPens; the release states that Mylan denies wrongdoing.
Connecticut Attorney General William Tong joined a coalition of 22 attorneys general in filing an amicus brief challenging DHS’s policy and practice of conducting warrantless civil immigration arrests. The press release describes a court challenge, not a privacy enforcement action or monetary penalty.
$625K
Connecticut reached a $625,000 settlement with Frontier Communications Parent Inc. over an April 2024 breach in which compromised employee and vendor credentials were used to access internal systems and exfiltrate unencrypted personal information of 58,841 Connecticut residents. The settlement requires Frontier to strengthen its security program, implement specific safeguards and training, and obtain an independent third-party assessment.
$2.6M
Connecticut and New York found that Boston Children’s Health Physicians and its security vendor, XTIUM, failed to use reasonable safeguards, resulting in hackers accessing sensitive personal, medical, and employee information. The companies agreed to pay penalties totaling $2.64 million and implement enhanced cybersecurity measures.