Google, Shein fined in France for cookie consent violations

France’s data protection agency CNIL has fined Google €325 million (US$380 million) and Shein €150 million (US$175 million) for violating cookie consent rules.

The regulator said both companies failed to obtain users’ informed consent before placing ad cookies on their browsers, affecting tens of millions of users in France.

Shein, an Asia-based fast-fashion retailer, was cited for not adequately informing users or providing clear options to withdraw consent, after placing cookies on 12 million French users’ devices monthly.

Google, which has faced previous CNIL fines over cookies, was also penalized for requiring users to accept tracking software when creating accounts, and for inserting ads into Gmail without proper consent.

Both firms can appeal the fines.

Google was ordered to update its systems within six months or risk additional daily penalties of €100,000.

Shein has updated its systems and plans to appeal.

🔗 Source: Agence France-Presse

🧠 Food for thought

1️⃣ Cookie violations show escalating enforcement pattern across jurisdictions

Google’s latest €325 million fine represents part of a clear escalation in regulatory penalties spanning over a decade.

The company first faced a $22.5 million FTC fine in 2012 for bypassing Safari’s privacy settings through tracking cookies 2. France’s CNIL then imposed a €50 million penalty in 2019 under GDPR for inadequate data transparency 3.

This latest French fine marks the third cookie-related penalty from CNIL alone, following €100 million in 2020 and €150 million in 2021 1. The progression shows regulators are becoming more aggressive with repeat offenders despite previous settlements.

Prosecutors initially requested an even higher €520 million penalty for Google’s current violations, suggesting authorities view continued non-compliance as justification for increasingly severe sanctions 1.

2️⃣ Fashion retailers face heightened scrutiny as cookie enforcement expands beyond tech giants

Shein’s €150 million fine demonstrates that cookie enforcement is expanding beyond traditional tech companies to include retail platforms with significant digital advertising operations.