France’s data protection authority CNIL delivered a crushing blow to tech giants on September 3, 2025, imposing €475 million in combined fines on Google and SHEIN for serious cookie consent violations that affected millions of users in France. Google received the heaviest penalty with €325 million (€200 million for Google LLC and €125 million for Google Ireland), while Chinese e-commerce giant SHEIN was hit with €150 million for flagrant disregard of user privacy rights.
Google’s Misleading Consent Flow and Gmail Ads
The Google fine stems from the company’s deceptive signup process for new accounts, which encouraged users to approve advertising-related trackers without clearly informing them that access to Google’s services was conditioned on advertising trackers, making the consent invalid. CNIL found that these practices violated French law, with approximately 53 million users in France subsequently seeing unwanted ads in Gmail’s “Promotions” and “Social” tabs without proper consent. Google has six months to comply or face €100,000 per day in penalties.
SHEIN’s Systematic Cookie Consent Failures
SHEIN’s €150 million penalty represents a major GDPR fine against a Chinese e-commerce company, underscoring that regulators will not tolerate privacy violations regardless of the company’s origin. The investigation revealed that SHEIN’s website failed to properly explain cookie usage, made rejection impossible even when users clicked “Reject All,” and continued to read existing cookies despite user objections.
The CNIL noted that SHEIN’s French website receives about 12 million monthly visitors, highlighting the potential scale of impact. In many cases, cookies were placed immediately upon site arrival before users could express any choice. SHEIN has said it will appeal, calling the decision “wholly disproportionate” and “politically motivated.”
Global Enforcement Implications
These fines arrive amid heightened geopolitical tensions over digital regulation, with President Donald Trump recently threatening tariffs and export restrictions against countries that tax or regulate U.S. tech companies. CNIL’s decision to penalize both American and Chinese companies equally underscores that European privacy enforcement operates independently of political pressure and focuses on protecting consumer rights. The Wall Street JournalReutersCNA
Company Responses
SHEIN has announced it will appeal, calling the decision “wholly disproportionate” and “politically motivated,” while Google said users can control the ads they see and highlighted recent updates addressing CNIL’s concerns.
Why This Matters for Web Analytics
For web analytics professionals, these cases underscore the critical importance of implementing compliant cookie consent mechanisms that provide users with genuine choice rather than manipulative interfaces designed to maximize data collection. The era of “consent theater” has definitively ended, replaced by strict enforcement that prioritizes user rights over business convenience.
The Wall Street JournalReuters