Ulta Beauty faces mounting legal pressure after a court determined its privacy policy alone cannot constitute valid consent under the California Invasion of Privacy Act.
The ruling stems from the class action case Wright v. Ulta Salon, Cosmetics & Fragrance, Inc., filed in California’s Southern District Court under case number 3:22-cv-01954.
At the heart of the lawsuit is Ulta’s use of session replay software, a web tracking technology that records and monitors user behaviour on websites.
The complaint asserts that the web tracking technology surreptitiously intercepts users’ data and communications in violation of the California Invasion of Privacy Act and the federal Wiretap Act.
Session replay tools can capture keystrokes, mouse movements, clicks, and other detailed interactions, raising significant questions about what users knowingly agree to when visiting a website.
The court’s decision adds to a growing body of case law examining whether standard privacy policies can serve as a legal basis for collecting user data without additional, explicit consent.
A central question in the case concerns what legally qualifies as an “interception” under CIPA, and whether website operators can be considered a party to the communications they facilitate.
Courts have generally held that CIPA requires explicit, affirmative opt-in consent before collecting user data, and that passive consent such as “by continuing to browse” is insufficient.
The ruling also addresses whether collecting IP addresses or device identifiers alone is sufficient to trigger CIPA liability, a question with wide-ranging implications for the digital advertising industry.
One of the key legal principles at issue is that consent obtained after the fact does not cure a prior interception, meaning retroactive disclosures carry little legal weight.
The decision signals that cookie banners and buried privacy policy language may no longer offer businesses the legal protection they have long assumed such notices provide.
For UK and international businesses operating websites that target or capture data from California residents, the ruling serves as a sharp reminder to review consent mechanisms urgently.
The case reflects a broader judicial trend in which American courts are scrutinising the gap between what companies disclose in privacy documents and what users genuinely understand or agree to.
Legal experts advising businesses on data compliance are increasingly recommending granular, upfront consent disclosures rather than reliance on general privacy policy terms alone.
Ulta Beauty, a major US cosmetics and beauty retailer, has not yet responded publicly to the court’s findings in a manner that has been widely reported.