[Enforcement library](/enforcement)

# SHEIN: check cookies before choice and after refusal

You can test whether refusal changes cookie behaviour. CNIL’s 2025 SHEIN sanction also covers cookies before consent and after withdrawal.

CNIL · French Data Protection Act, Article 82 · Sanction announced 3 September 2025

- Case record
- What happened
- Technical behaviour
- Checks for your own systems
- Sources and limits

## Case record

| Fact | Record |
| --- | --- |
| Authority | CNIL, France’s data protection authority |
| Entity | INFINITE STYLES SERVICES CO. LIMITED, SHEIN group |
| Jurisdiction and law | France · French Data Protection Act, Article 82 (ePrivacy) |
| Action | CNIL imposed a sanction on 1 September 2025 |
| Announced | 3 September 2025 |
| Amount | EUR 150 million administrative fine |
| Source review | 16 October 2026 |

[CNIL announcement](https://www.cnil.fr/en/cookies-placed-without-consent-shein-fined-150-million-euros-cnil). CNIL imposed this cookie sanction under Article 82 of the French Data Protection Act. It is not a fine under the General Data Protection Regulation (GDPR).

## What happened

CNIL found that the site placed cookies before a choice. It also found that the site placed or read some cookies after refusal or withdrawal. Its findings included incomplete information about purposes and third parties.

SHEIN made changes during the proceedings. CNIL said that these changes removed the need for a compliance order. [CNIL account](https://www.cnil.fr/en/cookies-placed-without-consent-shein-fined-150-million-euros-cnil)

## Technical behaviour

Inth’s technical interpretation: each consent state needs a separate test. Scripts, later page visits, queued events, and changed choices can create different paths to storage or data transfer. A control can look correct while another path bypasses it.

## Checks for your own systems

### In the repository

- Find each script, embedded resource, and code path that writes to storage.
- Include code from the tag manager and server.
- Map each path to its stated purpose.
- Trace refusal and withdrawal to script controls, queued events, and active integrations.
- Find what changes after a person updates a choice.

### In the browser and network

- Use separate fresh sessions for no choice, acceptance, and refusal.
- Test withdrawal in a session with an earlier acceptance.
- Record storage writes, storage reads, and network destinations on the first page load.
- Repeat the check after navigation.
- Compare the results with the purpose of each cookie.

### With the people responsible for data use

- Compare the observed tools with the purposes and third parties that the site names.
- Ask the data owner to review each claim that a cookie does not need consent.
- Check what happens to identifiers that the site stored before withdrawal.

## Sources and limits

[CNIL announcement, 3 September 2025](https://www.cnil.fr/en/cookies-placed-without-consent-shein-fined-150-million-euros-cnil). The announcement cites decision SAN-2025-005.

Source review: 16 October 2026. This page describes CNIL’s cited inspection and sanction. It does not audit SHEIN’s current website.

This review does not establish later appeal outcomes or payment. Inth wrote these technical checks. They cannot decide which laws apply or prove compliance with a law or contract.

A browser capture cannot show all server operations. A cookie alone does not decide whether consent is necessary. The removal of a local identifier does not reverse an earlier data transfer.

Related: [Sephora and opt-out signals](/enforcement/sephora) · [Honda and unequal choices](/enforcement/honda).

Explore [Consent banner](/consent-banner) and [Website audit](/website-audit).