Enforcement · French Data Protection Authority (CNIL) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.
INFINITE STYLES SERVICES CO. LIMITED: Insufficient legal basis for data processing
The French DPA has imposed a fine of EUR 150,000,000 on INFINITE STYLES SERVICES CO.
Full text
The French DPA has imposed a fine of EUR 150,000,000 on INFINITE STYLES SERVICES CO. LIMITED, which operates under the name 'SHEIN'. The controller used cookies unlawfully on its website. Firstly, the controller failed to obtain the data subject's consent before placing cookies. Second, the controller used incomplete cookie banners. Third, the controller failed to provide adequate second-level information. Finally, the controller's mechanisms for refusing or withdrawing consent were inadequate.
Industry: Industry and Commerce
How it connects
References
Related across sources
3 O 762/19 LG Rostock: Pre-ticked cookie consent boxes invalid under Art 6(1)(a) GDPR The German consumer organisation Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband e.V. (vzbv, the claimant) filed a lawsuit… Sep 15, 2020 Consent Legitimate Interest Controllers
C-210/16 Unabhängiges Landeszentrum für Datenschutz v Wirtschaftsakademie Schleswig-Holstein C-210/16 (Wirtschaftsakademie) CJEU Jun 5, 2018 IP Address Controllers Processors
451423 French Supreme Court reviews CNIL €35M cookie consent fine against Amazon The French DPA had received a complaint on 28 May 2018 regarding the lawfulness of processing by Amazon Europe Core ('Provider' or 'The company'). The French DPA had forwarded… Supreme Administrative Court Jun 27, 2022 Consent Cookies Supervision
C-507/17 Google LLC v CNIL C-507/17 (Google Territorial Scope) CJEU Sep 24, 2019 Territorial scope (GDPR) Right to be Forgotten Direct Marketing
449209 CE asks CJEU if GDPR one-stop-shop applies to ePrivacy cookie consent cases On 7 December 2020, the French DPA (CNIL) imposed two fines totaling € 100 million on Google LLC and Google Ireland Ltd for violating Article 82 of the French Data Protection Act… Jan 28, 2022 Consent Supervision Supervisory Authorities
449212 CE upholds CNIL competence to fine Google €100M for cookies despite no lead authority role On December, 7 2020, the French DPA imposed a financial penalty of 60 Million euros fine against Google LLC and a 40 million euros against Google Ireland Limited in accordance… Mar 4, 2021 Supervisory Authorities Supervision Cookies