CNIL fines Google €325 million and SHEIN €150 million for cookie non-compliance
The CNIL has issued hefty fines to Google (€325 million) and SHEIN (€150 million) for failing to comply with French rules on cookies and online tracking. These sanctions form part of a broader enforcement strategy started in 2019, when the CNIL published guidelines and a recommendation to improve transparency and legal compliance by operators that place tracking technologies on users’ devices.
Since 2020, several organizations have been sanctioned under Article 82 of the French Data Protection Act for non-compliant use of advertising cookies. The CNIL’s restricted committee has focused on high-traffic websites and services where large-scale tracking and targeted advertising present significant risks to user privacy, and it continues to monitor improvements in industry practices.
The committee underlined that cookies may only be placed after valid consent, and highlighted problematic patterns such as covert placement of cookies and “cookie walls” that condition access to services on consent. Consent must be freely given, informed and balanced: choices offered to users must be presented without bias or complexity that steers outcomes, and the consequences of accepting or refusing tracking must be clearly explained.
The CNIL also found a breach of Article L.34-5 of the French Postal and Electronic Communications Code by Google for displaying advertising emails in Gmail’s “Promotions” and “Social” tabs without users’ prior consent. The fines against Google and SHEIN reaffirm the regulator’s ongoing scrutiny of tracking, targeting and advertising practices and signal sustained enforcement against non-compliance.
