France's data protection authority (CNIL) has fined Shein €150 million for dropping advertising cookies on users' devices before they made any choice. four violations confirmed: The site placed advertising cookies automatically on arrival, before the consent banner was even interacted with. The banner itself was designed to obscure the choice, one version had no information about what the cookies were for the second pop-up had only an Accept button with No reject option. The second-level information didn't even identify which third parties were placing cookies. and when users did reject or withdraw consent, it didn't matter new cookies kept being placed and existing ones kept being read. 12 million people visit Shein's site in France every month. The company changed its website during the proceedings, which is why CNIL didn't issue a compliance order on top of the fine the violations were technically remediated but the fine stands. €150 million for a cookie banner designed to make consent meaningless. this is the gap between "we have a cookie banner" and "we actually respect consent." the banner existed. it just didn't work the way consent law requires — and for long enough to reach every person who visited the site during that period. the GDPR framework calls this a dark pattern. a consent mechanism engineered to collect regardless of what the user chooses. Shein's isn't the first. it won't be the last. but €150M is a number that tends to get other legal teams reading their own cookie implementations a little more carefully. Sources: CNIL official decision