People who made in-store purchases at Ulta Beauty stores in Virginia may be covered by a proposed class action alleging Ulta sold information from those purchases to third parties without the notice Virginia law requires. No class has been certified and there is nothing to file yet.
Allegations Only · No Settlement Yet
This article describes a class action complaint. The statements below are unproven allegations. Ulta Beauty has not been found liable, there is no certified class, and nothing to claim at this time. This page is informational and is not legal advice.
What Is This About?
A proposed class action filed November 13, 2026 accuses Ulta Beauty, Inc. of selling information about its Virginia in-store shoppers’ purchases to advertising and data partners without telling them first. The case is Dunk Frenchshall v. Ulta Beauty, Inc., No. 1:26-cv-14124, in the U.S. District Court for the Northern District of Illinois, where Ulta is headquartered. It is assigned to Judge Jorge Luis Alonso.The only claim is under the Virginia Personal Information Privacy Act, Va. Code § 59.1-442. The plaintiff, a Virginia resident, says she bought $33.92 of merchandise at an Ulta store in Chesapeake in May 2025 with a Cash App card and saw no sign at the entrance, checkout or payment terminal saying Ulta would sell information about the purchase. These are allegations. Ulta has not been found liable and had not responded in court as of November 14, 2026.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
What Does the Virginia Law Require?
Virginia’s Personal Information Privacy Act is a short statute aimed at the sale of customer information gathered at the store counter. It bars a merchant from selling information that “concerns the purchaser and that is gathered in connection with the sale, rental, or exchange of tangible personal property to the purchaser at the merchant’s place of business” to any third person without notice to the purchaser. The notice is what lets a shopper ask the store not to sell the information.A person harmed by a violation can recover $100 per violation plus reasonable attorneys’ fees and costs under Va. Code § 59.1-444. The law does not cover information gathered to extend credit, information obtained from public bodies, sales made with the sale of a merchant’s retail business, transfers incidental to selling accounts receivable or check-validation transactions. The complaint says none of those exceptions applies here.
What the Complaint Says Ulta Did With Purchase Data
According to the complaint, Ulta collects identifiers, payment information and purchase history when customers buy in its stores, and then makes that information available to outside companies. It points to four things:Ulta’s privacy policy. The complaint quotes the policy’s “Notice of Sale and Sharing,” which says Ulta “sells” and “shares” personal information through third-party analytics and advertising tools “on the Sites and offline,” as those terms are defined under California law. The complaint says this disclosure is not readily apparent to a shopper at a register.
LiveRamp and Snap. The complaint cites a published case study describing a 2020 partnership in which Ulta, Snap and the data company LiveRamp linked Ulta in-store purchases to ad measurement on Snapchat. On information and belief, it alleges Ulta can tie card transactions to identifiers mapped to individual shoppers even when the shopper does not give a name at checkout.
Epsilon and UB Media. The complaint says Ulta works with Epsilon to build customer profiles from loyalty data and to run campaigns through UB Media, Ulta’s retail media network, which sells brands access to Ulta’s shoppers.
NielsenIQ. The complaint cites an April 30, 2026 announcement of a “strategic data sharing collaboration” in which Ulta supplies sales data for a NielsenIQ product sold to beauty brands and retailers, and alleges Ulta benefits commercially from it.
The complaint anticipates a defense that Ulta shares only pseudonymous or aggregated data, or uses data clean rooms. It argues the statute protects any information that “concerns the purchaser,” not only a name or address, and cites a 2024 FTC staff post cautioning that clean rooms can carry many of the same privacy risks as other tracking tools. How the court reads the statute on that point is likely to be central to the case.
Who Could Be Covered and What the Case Seeks
The proposed class is every person who made an in-store purchase at an Ulta location in Virginia during the applicable limitations period. The complaint estimates the class at hundreds of thousands of people and says members can be identified from Ulta’s transaction records. It excludes the judges, Ulta and its affiliates and employees, and the lawyers in the case.The complaint asks the court to certify the class, declare that Ulta violated the statute and award $100 per violation, interest, and attorneys’ fees and costs. It also argues that shoppers suffered a privacy injury and lost the value of their personal information, which is meant to answer the question of whether a federal court has jurisdiction over a statutory privacy claim.
Ulta will be able to respond, likely with a motion to dismiss. A class would have to be certified, or the case settled, before any shopper could be paid. If that happens, notice would explain how to file a claim.
Questions
What does the Virginia Personal Information Privacy Act say about store purchases?
Section 59.1-442 of the Virginia Code says a merchant may not sell information that concerns a purchaser and was gathered in connection with an in-store sale of goods to a third person without giving the purchaser notice. The law gives the purchaser the right to ask that the information not be sold, and Section 59.1-444 provides $100 in damages per violation plus attorneys’ fees and costs. The statute has exceptions, including information gathered to extend credit, information from public bodies, check-validation transactions and the sale of a merchant’s retail operations.
Who is in the proposed class in the Ulta case?
The complaint proposes a class of all persons who made an in-store purchase at an Ulta location in Virginia during the applicable statute of limitations period. Online purchases and purchases at stores outside Virginia are not part of the proposed class. The court has not certified any class.
Did Ulta admit to selling customer data?
No court has found that Ulta sold anything. The complaint quotes the “Notice of Sale and Sharing” in Ulta’s privacy policy, which says Ulta “sells” and “shares” personal information through analytics and advertising tools “as defined under California law.” Whether that disclosure covers in-store purchase information, and whether it amounts to a sale under the Virginia statute, are questions the court has not decided. Ulta had not filed a response as of November 14, 2026.
Is there money available from the Ulta lawsuit?
No. The case was filed on November 13, 2026 and is at the complaint stage. There is no settlement, fund or claim form. The complaint asks for $100 per violation for each class member, but that amount would only be paid if the plaintiff won the case or the parties reached a settlement that a judge approved.
Is this the same as the Ulta marketing email lawsuit?
No. A separate case challenges Ulta marketing emails sent to Indiana consumers that allegedly used false “last day” deadlines. The Virginia case concerns in-store purchase information and a different state law. Each case has its own class, and being part of one does not make a person part of the other.
Sources
• CourtListener — Dunk Frenchshall v. Ulta Beauty, Inc., No. 1:26-cv-14124 (N.D. Ill.) docket and complaint• Code of Virginia — § 59.1-442, Sale of purchaser information
• Ulta Beauty — Privacy Policy
