INDEX / DIRECTORY / MAYBELLINE / V-DIG

Maybelline V-DIG

DIGITAL INFRASTRUCTURE AUDIT UPDATED 2026-05-19
V-DIG Score 0.81 /10 E Maybelline — BDS-1000 162
V-DIG 0.81

Evidence-only forensic audit. Scoring happens downstream — see the main dossier for the composite assessment.

V-DIG Audit: Maybelline (L’Oréal Group)

Audit Phase: V-DIG (Digital Forensics / Technology Supply Chain) Target: Maybelline New York — cosmetics brand owned by L’Oréal Group (Clichy, France) Audit Date: 2026-05-01

Structural Note: Maybelline New York is a brand, not an independent legal entity with its own IT procurement, cybersecurity, or data infrastructure function. All technology vendor relationships, cloud infrastructure decisions, and R&D investments are held and governed at the L’Oréal Group level. This structure is material to every section of this audit: findings attributed to Maybelline represent L’Oréal Group decisions applied across the brand portfolio, and evidence gaps at the brand level are expected and inherent to the organisational model.

Enterprise Technology Stack & Vendor Relationships

Cloud & Platform Infrastructure

L’Oréal Group publicly announced a strategic partnership with Google Cloud in 2021, covering data analytics, AI/ML workloads, and digital commerce infrastructure across its full brand portfolio, including Maybelline 1. Google Cloud is US-headquartered but operates significant engineering R&D presence in Israel (Tel Aviv and Haifa). More materially, Google Cloud is a co-contractor on Project Nimbus — the Israeli government and military cloud contract valued at approximately $1.2 billion 23. There is no public evidence that L’Oréal’s or Maybelline’s specific Google Cloud workloads are scoped, routed, or otherwise connected to Israeli government or military infrastructure. L’Oréal’s disclosed Google Cloud usage is consumer- and retail-facing.

L’Oréal Group disclosed a partnership with Microsoft in 2021 encompassing cloud productivity, AI capability, and digital retail applications across its brands 4. Microsoft maintains a major Israeli R&D centre and has involvement in Israeli government cloud programmes, but there is no public evidence of L’Oréal or Maybelline holding contracts or deploying services through Microsoft specifically in connection with Israeli state functions.

Salesforce has been publicly referenced as part of L’Oréal Group’s CRM and consumer data platform infrastructure 5. Salesforce is US-headquartered and has acquired Israeli-founded companies (notably ClickSoftware, prior to 2020) that contribute to its engineering base. There is no public evidence of a direct L’Oréal–Salesforce contract or integration specifically implicating Israeli-origin technology modules or Israeli state data flows.

Systems Integration & Consulting

L’Oréal Group has engaged Accenture for digital transformation programmes 6. Accenture operates globally, including in Israel, and has a broad mandate across enterprise technology stacks. No public evidence identifies Accenture as having mandated or deployed Israeli-origin technology specifically within L’Oréal or Maybelline-facing engagement workstreams. The Accenture engagement is confirmed only at the general digital transformation level in public sources 6.

Cybersecurity Vendor Relationships

No public evidence has been identified of L’Oréal Group or Maybelline holding verified licensing, subscription, or integration agreements with any of the following Israeli-origin cybersecurity vendors: Check Point Software, Wiz, SentinelOne, CyberArk, Claroty, Verint, or NICE Systems. L’Oréal’s cybersecurity posture and vendor-specific selections are not disclosed at the granularity required to confirm or rule out such relationships in publicly accessible corporate filings 785. Vendor-maintained customer case study pages for Check Point 9, Wiz 10, CyberArk 11, and NICE 12 do not surface L’Oréal or Maybelline as named clients in publicly accessible materials.

Surveillance, Biometrics & Retail Technology

ModiFace — Augmented Reality & Facial Mapping

L’Oréal Group acquired ModiFace in March 2018 13. ModiFace is a Canadian-origin company, founded by researchers at the University of Toronto and headquartered in Toronto and San Francisco 14. It is not of Israeli origin. ModiFace provides augmented reality virtual try-on capability and facial landmark detection for cosmetics applications. Maybelline New York is an explicit and publicly confirmed user of ModiFace technology for virtual lipstick, eye shadow, and foundation try-on experiences across its digital properties and social media integrations 15.

ModiFace’s technology employs machine learning–based facial feature mapping to superimpose cosmetic product simulations in real time. It does not perform biometric identification, persistent identity matching, or law enforcement–grade facial recognition. It is appropriately classified as AR/cosmetics technology rather than surveillance biometrics. L’Oréal’s corporate science and technology disclosures reference ModiFace centrally in beauty tech innovation 16.

Trax Image Recognition — Retail Shelf Analytics

Trax is a retail shelf analytics company with Israeli founding heritage (Israeli founding team, R&D infrastructure in Israel, incorporated in Singapore) 17. Trax deploys computer vision to analyse physical retail shelf conditions including planogram compliance, out-of-stock detection, and share-of-shelf measurement. Trade press references indicate L’Oréal as among Trax’s consumer packaged goods clients for shelf analytics and retail execution monitoring. Confidence level: moderate. No primary corporate disclosure — neither an L’Oréal press release, annual report entry, nor a Trax-published named case study with primary sourcing — has been confirmed at the level required for definitive verification 7817. If confirmed, the application is retail operations management (B2B shelf-monitoring), not consumer surveillance or biometric data collection.

Israeli Facial Recognition & In-Store Surveillance Vendors

No public evidence has been identified of L’Oréal or Maybelline deploying products or services from AnyVision/Oosto, BriefCam, Trigo, or comparable Israeli-origin facial recognition or loss-prevention vendors. Sources checked include vendor customer case study pages, the Who Profits corporate database 18, and trade press covering retail surveillance technology adoption in the consumer goods sector.

Predictive Analytics, Workforce Monitoring & Social Media Surveillance

No public evidence identified of L’Oréal or Maybelline deploying Israeli-origin tools in the categories of predictive social media monitoring, workforce surveillance, or consumer behavioural profiling using Israeli-origin platforms. No evidence of third-party platform delivery of Israeli-origin surveillance technology into L’Oréal or Maybelline systems has been identified.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

Data Centre Operations in Israel

No public evidence has been identified that L’Oréal Group or Maybelline operates, leases, or co-locates data centre or server infrastructure within the State of Israel. L’Oréal’s primary disclosed data infrastructure is associated with its partnerships with Google Cloud 1 and Microsoft 4, both of which are US-headquartered hyperscale platforms. No colocation agreements, sovereign cloud participation arrangements, or Israeli-region cloud deployments are disclosed in L’Oréal’s annual reports or sustainability filings 785.

Project Nimbus

Project Nimbus is a contract between the Government of Israel and the Israeli Defence Forces, on one side, and Google Cloud and Amazon Web Services, on the other, providing cloud computing, AI, and data services to the Israeli state and military apparatus 23. L’Oréal is a Google Cloud customer 1, but there is no public evidence that L’Oréal is a named sub-contractor, participating vendor, or otherwise operationally embedded within the Project Nimbus contracting structure. L’Oréal’s disclosed Google Cloud usage is oriented toward consumer-facing digital commerce, AI-driven beauty recommendations, and brand analytics rather than state or government-adjacent workloads. Sources checked include Project Nimbus reporting 23, disclosures by the No Tech for Apartheid campaign 3, and L’Oréal’s corporate disclosures 78.

Data Sovereignty Services for Israeli State Institutions

No public evidence identified. L’Oréal operates as a consumer goods company and does not publicly market or provide technology-as-a-service, cloud resilience services, or data sovereignty infrastructure to any state entity.

Defence, Intelligence & Security Sector Technology Relationships

Military and Intelligence Contracts

No public evidence has been identified of Maybelline or L’Oréal Group holding any contract, memorandum of understanding, or commercial relationship with the Israeli Ministry of Defence, the Israel Defence Forces, Israeli military intelligence (Aman), the Shin Bet, or Mossad. Sources checked include the Who Profits corporate database 1819, L’Oréal’s consolidated annual reports 78, L’Oréal’s sustainability and responsibility disclosures 5, and available English-language Israeli public procurement records.

Dual-Use Technology Provision

No public evidence has been identified that any technology commercially deployed by L’Oréal or Maybelline — including ModiFace AR systems, shelf analytics tools, or AI-driven beauty personalisation platforms — has been reported or alleged to have been deployed for military, intelligence, or law enforcement surveillance purposes in Israel or in the Occupied Palestinian Territories.

Offensive Cyber and Weapons Technology

No public evidence identified. This category is not applicable to a consumer cosmetics company. No relationship with Israeli offensive cyber vendors (e.g., NSO Group, Candiru, Paragon) or weapons systems integrators has been identified in any source reviewed.

AI, Algorithmic & Autonomous Systems

AI and ML Provision to Israeli State Bodies

No public evidence identified. L’Oréal Group’s disclosed AI investments and deployments are consumer-facing, covering beauty product recommendation engines, virtual try-on (via ModiFace 1513), personalisation algorithms, and supply chain optimisation 1620. No L’Oréal or Maybelline AI system has been identified in public sources as licensed, transferred, or otherwise made available to any Israeli state body, military organisation, or intelligence agency.

ModiFace AI — Facial Feature Mapping

ModiFace deploys machine learning models for real-time facial landmark detection and AR rendering, enabling Maybelline’s virtual try-on product experiences 1513. The system’s inputs are user-device camera feeds processed locally or in cloud environments; the outputs are cosmetic product visual overlays. It is Canadian in origin 14, commercially scoped, and the disclosed application is consumer cosmetics retail. No dual-use, law enforcement, or state security application of ModiFace AI has been identified in public sources.

Training Data Provenance

No public evidence identified that L’Oréal or Maybelline has used datasets derived from surveillance of populations in occupied territories, Israeli state biometric databases, or conflict-zone data collection for training its AI or ML systems. L’Oréal’s published sustainability and responsibility disclosures do not address AI training data provenance at a level of granularity that would confirm or deny this 205.

Autonomous Target Generation and Lethality Systems

No public evidence identified. Not applicable to a cosmetics brand.

Technology Ecosystem & R&D Footprint

Israeli R&D Presence

L’Oréal Group maintains a confirmed commercial and operational presence in Israel — sales operations, local brand marketing, and product distribution — as evidenced by its dedicated Israel country page 21. Trade press reporting from approximately 2019 to 2022 references L’Oréal participation in Israeli innovation ecosystem events and alludes to a “tech hub” or technology scouting presence in Tel Aviv [S9]. However, no primary corporate disclosure in L’Oréal’s annual reports (2020–2023) 78 or official press releases has been identified confirming a formal, dedicated R&D centre or engineering office of significant scale operating in Israel. The source underpinning the Tel Aviv tech hub claim could not be verified at primary source level with sufficient confidence for citation; it is noted as an evidence gap rather than a confirmed finding.

L’Oréal’s primary technology R&D infrastructure is publicly documented as centred in France (Clichy and Aulnay research campuses), Canada (ModiFace/Toronto engineering team), and the United States.

Acquisitions of Israeli-Origin Technology Companies

No public evidence identified. L’Oréal’s disclosed technology acquisitions include ModiFace (Canadian, March 2018) 1322 and Gjosa (Swiss water technology, 2021) 22, among others. No acquisition of an Israeli-origin technology company is present in L’Oréal’s publicly disclosed acquisition history as reflected in annual reports 78 and corporate press release archives 22.

Patent and IP Co-Development with Israeli Academic Institutions

No public evidence identified of L’Oréal or Maybelline holding joint patents, sponsored research agreements, or IP co-development arrangements with Israeli academic institutions including the Technion–Israel Institute of Technology, the Hebrew University of Jerusalem, or the Weizmann Institute of Science. Sources checked include Technion’s publicly listed industry partnership pages 23 and L’Oréal’s IP and innovation disclosures across annual reports 78.

Civil Society Scrutiny & Regulatory History

Who Profits Research Center

The Who Profits Research Center maintains a corporate database documenting economic activity by companies in Israeli-occupied territories 1819. L’Oréal appears in the Who Profits database in connection with its commercial retail and distribution operations in Israel and the sale and distribution of products within Israeli settlements in the West Bank. The Who Profits entry for L’Oréal focuses on this retail and commercial presence; no Who Profits entry specifically addressing Maybelline’s or L’Oréal’s technology supply chain, digital infrastructure, or vendor relationships with Israeli technology firms has been identified 18.

BDS Movement

The Boycott, Divestment and Sanctions movement has included L’Oréal on consumer-facing campaign lists targeting companies with Israeli commercial operations 24. BDS campaign materials reviewed focus on L’Oréal’s retail presence, factories, and distribution activity in Israel, not on the company’s technology procurement, cybersecurity vendors, cloud infrastructure, or digital supply chain. No BDS or allied civil society campaign specifically targeting Maybelline’s or L’Oréal’s technology vendor relationships with Israeli technology firms has been identified.

No public evidence identified of regulatory inquiries, export control enforcement actions, sanctions-related investigations, or consumer data protection proceedings specifically involving L’Oréal’s or Maybelline’s technology relationships with Israeli entities or Israeli-origin technology vendors. L’Oréal’s regulatory disclosures in its annual reports 78 and sustainability documents 5 do not reference any such proceedings.

End Notes

Footnotes

  1. https://cloud.google.com/blog/topics/consumer-packaged-goods/loreal-google-cloud-partner ↩ ↩2 ↩3

  2. https://www.theguardian.com/technology/2021/oct/12/google-amazon-israel-project-nimbus-military-contract ↩ ↩2 ↩3

  3. https://time.com/6972022/no-tech-for-apartheid-google-amazon-workers/ ↩ ↩2 ↩3 ↩4

  4. https://news.microsoft.com/2021/06/14/loreal-microsoft/ ↩ ↩2

  5. https://www.loreal.com/en/commitments-and-responsibilities/ ↩ ↩2 ↩3 ↩4 ↩5 ↩6

  6. https://www.accenture.com/us-en/client-story/loreal-digital ↩ ↩2

  7. https://www.loreal-finance.com/en/annual-report-2023/ ↩ ↩2 ↩3 ↩4 ↩5 ↩6 ↩7 ↩8 ↩9

  8. https://www.loreal-finance.com/en/annual-report-2022/ ↩ ↩2 ↩3 ↩4 ↩5 ↩6 ↩7 ↩8 ↩9

  9. https://www.checkpoint.com/customers/ ↩

  10. https://www.wiz.io/customers ↩

  11. https://www.cyberark.com/customers/ ↩

  12. https://www.nice.com/ ↩

  13. https://www.loreal.com/en/press-releases/acquisitions/loreal-acquires-modiface/ ↩ ↩2 ↩3 ↩4

  14. https://www.crunchbase.com/organization/modiface ↩ ↩2

  15. https://www.loreal.com/en/articles/science-and-technology/modiface-augmented-reality/ ↩ ↩2 ↩3

  16. https://www.loreal.com/en/science-and-technology/ ↩ ↩2

  17. https://traxretail.com/ ↩ ↩2

  18. https://www.whoprofits.org/company/loreal ↩ ↩2 ↩3 ↩4

  19. https://www.whoprofits.org/page/about-who-profits ↩ ↩2

  20. https://www.loreal.com/en/commitments-and-responsibilities/for-the-future/ ↩ ↩2

  21. https://www.loreal.com/en/israel/ ↩

  22. https://www.loreal.com/en/press-releases/acquisitions/ ↩ ↩2 ↩3

  23. https://www.technion.ac.il/en/industry/ ↩

  24. https://bdsmovement.net/industries-and-companies ↩