In the first public enforcement action of California's landmark data-privacy law, the state's attorney general on Wednesday announced a $1.2 million settlement with Sephora Inc.