NBC: Cosmetics retailer Sephora to pay $1.2 million under sweeping California privacy law