The encyclopedia · Legal & Compliance · Legal decision · 2025
France fined SHEIN €150 million for dropping tracking cookies without consent
CNIL hit the Chinese-founded fast-fashion group's Irish subsidiary with one of the largest cookie fines ever for ignoring users' refusal choices
Infinite Styles Services Co. Limited · SHEIN · 2025-09-01
What happened
On September 1, 2025, France's data-protection authority CNIL fined Infinite Styles Services Co. Limited — the Irish subsidiary of the Chinese-founded SHEIN group — €150 million for placing advertising and tracking cookies on French users' devices without their consent. CNIL said the fine was one of the largest ever issued for cookie and consent violations.
The regulator found SHEIN had placed cookies that carried no consent requirement, ignored users who had refused or withdrawn consent, and showed an incomplete consent banner that did not give users a genuine choice. The conduct breached Article 82 of the French Data Protection Act, which requires consent before storing or accessing information on a device.
CNIL also ordered SHEIN to stop the unlawful practices and to comply with its requests within a set period.
Why it happened
- SHEIN prioritised ad tracking over the consent its own banner appeared to offer, using cookies that ignored refusal and withdrawal choices
- An incomplete consent banner meant the company's tracking was never actually authorised under French law, turning a compliance detail into a record-scale fine
The lesson
A cookie banner that does not give users a real choice is not consent — and consent is the only thing that makes tracking legal, whatever the platform's size
Aftermath
SHEIN said it would comply with the decision and review its cookie practices. The fine underscored regulators' turn toward enforcement against large platforms that treat consent as a formality.
Sources
- CNIL — Cookies placed without consent: SHEIN fined €150 million
- Browne Jacobson — Cookie compliance crackdown: SHEIN fined €150 million by CNIL
spotted an error? The club wants to know.
More like this
Meta's 'designed for privacy' glasses shipped users' intimate footage to Kenya reviewers
Amazon's €746M GDPR record fine was scrapped on a technicality
AliExpress got a €550M EU fine — the DSA's first big test landed on Alibaba
Somewhere, someone solved the problem this company failed at. 2nd Opinion →
Comments · 0
Sign in to join the comments.