INFINITE STYLES SERVICES CO. LIMITED – €150,000,000 Fine (France, 2025)

SHEIN is a company that sells clothing via its website “shein.com”. This website is managed by INFINITE STYLES SERVICES CO. LIMITED (based in Ireland, the controller) for the European territory. It is a subsidiary of by ROADGET BUSINESS PTE, which is based in Singapore. Its French establishment INFINITE STYLES ECOMMERCE FRANCE is wholly owned by the Irish subsidiary, and promotes SHEIN products in France. The DPA carried out an ex-officio investigation in July 2023, regarding the controller’s website and cookie related violations. The controller argued that the DPA was not competent, because the cookies involved processing of personal data and therefore the GDPR was applicable. This meant the Irish DPA was competent under the one-stop-shop mechanism. In addition, the controller argued that INFINITE STYLES ECOMMERCE FRANCE cannot be considered an establishment within the meaning of the CJEU’s decision in Weltimmo. In addition, the controller denied placing cookies without the data subjects’ consent. The DPA first established INFINITE STYLES SERVICES CO. LIMITED as the controller, in accordance with Article 4(7) GDPR. This is because the company manages the website domains in the EU, a fact that is specified in its privacy policy. The CNIL also clarified matters of material and territorial competence; the case fell under the scope of the ePrivacy Directive, as setting cookies were set in the context of publicly available electronic communications services through a public electronic communications network. In the absence of a one stop shop mechanism, the DPA was responsible for monitoring the application of the ePrivacy Directive regarding processing in the context of the activities of an establishment of a cross-border entity on French territory. The DPA dismissed the controller’s arguments on the lack of establishment in France, as the French location belonged to the same group as the controller and pursued the same economic interests. The DPA also referred to the CJEU’s reasoning in Google Spain and Weltimmo to conclude that the French establishment sufficiently facilitated the processing of personal data by the controller in France. The DPA found a violation of [https://www.cnil.fr/fr/le-cadre-national/la-loi-informatique-et-libertes#article82 Article 82 of the French Data Protection Act] (transposing Article 5(3) of the ePrivacy Directive). Under Article 82, the controller may only place non-essential cookies with the consent of the data subject. The controller set cookies before data subjects interacted with the cookie banner (including advertising cookies), meaning data subjects were unable to consent to or reject the cookies. In addition, the controller did not provide sufficient information regarding the cookies or third parties involved in its cookie banner. For example, the controller did not disclose who was setting third party cookies (this was later amended by the controller). Furthermore, the controller also divided the information in a consent banner and pop-up window. The DPA considered this potentially confusing for the data subject. The data subjects’ consent in this case was not informed, due to the lack of information. Finally, the controller did not allow data subjects to meaningfully reject cookies or withdraw their consent; the website still set cookies even if the data subject rejected them or withdrew consent. The DPA fined the controller €150 million, taking into consideration the controller’s lack of compliance with several cookie related obligations. The DPA also considered the SHEIN's central position in the online ready-to-wear clothing sector, with an average of 12 million data subjects in France visiting its website every month.