INFINITE STYLES SERVICES CO. LIMITED – €150,000,000 Fine (France, 2025)

SHEIN is a company that sells clothing via its website “shein.com”. This website is managed by INFINITE STYLES SERVICES CO. LIMITED (based in Ireland, the controller) for the European territory. It is a subsidiary of by ROADGET BUSINESS PTE, which is based in Singapore. Its French establishment INFINITE STYLES ECOMMERCE FRANCE is wholly owned by the Irish subsidiary, and promotes SHEIN products in France. The DPA carried out an ex-officio investigation in July 2023, regarding the controller’s website and cookie related violations. The controller argued that the DPA was not competent, because the cookies involved processing of personal data and therefore the GDPR was applicable. This meant the Irish DPA was competent under the one-stop-shop mechanism. In addition, the controller argued that INFINITE STYLES ECOMMERCE FRANCE cannot be considered an establishment within the meaning of the CJEU’s decision in Weltimmo. In addition, the controller denied placing cookies without the data subjects’ consent. The DPA first established INFINITE STYLES SERVICES CO. LIMITED as the controller, in accordance with Article 4(7) GDPR. This is because the company manages the website domains in the EU, a fact that is specified in its privacy policy. The CNIL also clarified matters of material and territorial competence; the case fell under the scope of the ePrivacy Directive, as setting cookies were set in the context of publicly available electronic communications services through a public electronic communications network. In the absence of a one stop shop mechanism, the DPA was responsible for monitoring the application of the ePrivacy Directive regarding processing in the context of the activities of an establishment of a cross-border entity on French territory. The DPA dismissed the controller’s arguments on the lack of establishment in France, as the French location belonged to the same group as the controller and pursued the same economic interests. The DPA also referred to th