France’s CNIL fined Google $379M and Shein $175M for breaching cookie rules

According to CNIL, the French data watchdog, Google was fined $379 million (€325 million) and Shein $175 million (€150 million) for breaching cookie rules. The sanctions, part of CNIL’s ongoing cookie enforcement, addressed issues such as placing cookies without user consent and the use of cookie walls to access services.

The CNIL ruled that Google displayed advertisements in Gmail’s Promotions and Social tabs without prior consent and that consent obtained during Google account creation was not valid, breaching Article L.34-5 CPCE and triggering the six-month compliance window with potential €100,000 daily fines for delays.

Shein was sanctioned for multiple cookie violations, including ads cookies without consent, incomplete banners, no information on third-party trackers, and ineffective refusal or withdrawal options, even though the retailer later updated its site. Shein says it will appeal, arguing it is fully compliant, while CNIL’s action forms part of a broader strategy aimed at curbing non-consensual cookie practices.