Cookies and Consent: When Google and Shein’s Appetite Costs EUR 475 Million

What is this about?

On 1 September 2025, in two separate decisions, the French data protection authority, the Commission nationale de l’informatique et des libertés (the “CNIL”), strongly reaffirmed the importance of consent by imposing fines of EUR 325 million on Google LLC and Google Ireland Limited (together, “Google”) and EUR 150 million on Infinite Styles Services Co. Limited, better known as SHEIN (“Shein”).

Background: The hunt for cookies under a strict legal framework

By reaffirming its direct jurisdiction over tracking technologies (“Cookies”), the CNIL notably found that:

In Decision No. SAN-2025-004 concerning Google (EUR 325 million fine), the way in which Google obtained users’ consent for advertising Cookies and for displaying advertisements in Gmail inboxes deprived users of the ability to provide free and informed consent.

According to the CNIL, the mechanism biased users’ choices in favour of personalised advertising. Their consent could therefore not be considered informed, as users were not sufficiently informed that access to the service was conditional upon the placement of Cookies.

In addition, advertisements displayed in Gmail that resembled emails were considered to constitute unsolicited direct marketing.

In Decision No. SAN-2025-005 concerning Shein (EUR 150 million fine), the placement of advertising, frequency-capping and audience-measurement Cookies on users’ devices as soon as they accessed the website, without first obtaining their consent, was found to infringe users’ rights.

In addition, the information banners were considered incomplete, while the mechanisms for refusing or withdrawing consent were found to be inadequate.

These two CNIL decisions are based on Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (the “GDPR”), as well as Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (the “ePrivacy Directive”).

In practice: the consequences of these decisions

These two cases highlight the importance of ensuring the validity and quality of users’ consent, particularly in relation to Cookies.

For Google, the key issue was to provide users with a genuinely free choice, including equivalent options to accept or reject Cookies, together with clear information about the implications of Cookies, particularly the relationship between the free provision of the service and advertising.

The classification of advertisements displayed in Gmail as direct marketing also represents a significant development.

What is the impact in Luxembourg?

These decisions are directly relevant to Luxembourg companies.

The GDPR is directly applicable in Luxembourg, while the principles of the ePrivacy Directive have been transposed into national law by the Law of 30 May 2005 laying down specific provisions for the protection of persons with regard to the processing of personal data in the electronic communications sector and amending Articles 88-2 and 88-4 of the Code of Criminal Procedure.

Accordingly, and as a result of this transposition, the Luxembourg data protection authority, the Commission Nationale pour la Protection des Données (the “CNPD”), can reasonably be expected to adopt a similarly vigilant approach to consent and Cookies.

Any company operating in Luxembourg, or targeting residents of the European Union, must therefore ensure that its practices relating to Cookies and direct marketing fully comply with these principles.

To achieve this, Luxembourg companies would benefit from implementing a genuine compliance strategy for Cookies and electronic marketing, including:

• Adopting a clear Cookie Policy and updating it regularly;
• Implementing a compliant consent banner, with balanced choices, complete information and an easy withdrawal mechanism;
• Establishing internal procedures to document the collection and management of consent;
• Raising awareness among marketing and technical teams of the applicable rules.

It is also advisable to integrate these aspects into the company’s overall data protection policy and to regularly review the practices of third-party partners in order to mitigate the risk of liability before the CNPD.

➡️ For any questions relating to IP/IT matters or, more specifically, the GDPR, please contact Mathilde Wazana Moock or Nicolas Thieltgen.