Shein is a fast-fashion e-commerce platform operated through multiple entities: SHEIN US Services, LLC provides the US site and app, the iOS app's listed developer is Roadget Business Pte. Ltd. (Singapore), and group affiliates include Infinite Styles Services Co. Limited (Ireland) and Zoetop Business Company, Ltd. Its US privacy policy (effective March 31, 2026) describes collection of device and online identifiers, network activity, and preference/inference data including body measurements, largely used for targeted advertising via cookies, tags, and web pixels. The policy states identifiers and inferences shared with partners may be interpreted as "selling" or "sharing" under state privacy laws, and offers an opt-out. Regulators have acted: a 2022 New York AG breach settlement, a 2025 CNIL cookie-consent fine of 150 million euros, and EU DSA proceedings opened in February 2026.
TRACK RECORD
1 BREACH · 2 ENFORCEMENT ACTIONS
BREACH LEDGER
[2018-06-01] · BREACH
Have I Been Pwned lists a breach record for Shein: "SHEIN".
Approximately 39,086,762 accounts affected, per HIBP.
On February 17, 2026, the European Commission opened formal proceedings against Shein under the Digital Services Act concerning its addictive design, the lack of transparency of its recommender systems, and the sale of illegal products; these are proceedings, not findings of infringement.
In an October 12, 2022 settlement, the New York Attorney General required Zoetop Business Company, Ltd. — then owner of SHEIN and ROMWE — to pay $1.9 million after a 2018 data breach in which 39 million SHEIN accounts and 7 million ROMWE accounts were stolen; the OAG's investigation found the company failed to properly safeguard consumer information and downplayed the extent of the cyberattack to consumers.
Shein's US Privacy Policy (effective March 31, 2026) states that it collects device/online identifiers — including MAC address, IP address, cookie IDs, mobile ad IDs, and social media information — as well as preference, behavior, and inference data such as indicated body shape and measurements, with these categories marked as used for targeted advertising.
The developer of record for the SHEIN iOS app on Apple's App Store is Roadget Business Pte. Ltd., a Singapore-incorporated entity distinct from the consumer-facing SHEIN brand name.
On April 26, 2024, the European Commission formally designated Shein as a Very Large Online Platform (VLOP) under the Digital Services Act, based on its self-reported average of more than 45 million monthly EU users, subjecting it to the DSA's most stringent transparency and risk-mitigation obligations.
Shein's US Privacy Policy (effective March 31, 2026) identifies SHEIN US Services, LLC as the entity providing the US site and app and responsible for collecting, processing, and protecting personal data — a separate entity from the app's Singapore-based developer of record and from the group's Irish and Hong Kong affiliates named in regulator actions.
Shein's US Privacy Policy (effective March 31, 2026) states that in the previous 12 months it may have shared identifiers and inferences with partners, third parties, and affiliates in ways that may be interpreted as "selling" or "sharing" under state privacy laws; the same policy states Shein does not sell user information to third parties "as that term is generally understood" and provides a "Do Not Sell or Share My Personal Information" opt-out link.
Have I Been Pwned's breach catalog lists the "SHEIN" incident (shein.com), breach date 2018-06-01, affecting approximately 39,086,762 accounts. Data classes exposed per HIBP: Email addresses, Passwords. Source: Have I Been Pwned (haveibeenpwned.com), CC BY 4.0.
In an October 12, 2022 settlement, the New York Attorney General required Zoetop Business Company, Ltd. — then owner of SHEIN and ROMWE — to pay $1.9 million after a 2018 data breach in which 39 million SHEIN accounts and 7 million ROMWE accounts were stolen; the OAG's investigation found the company failed to properly safeguard consumer information and downplayed the extent of the cyberattack to consumers.
On February 17, 2026, the European Commission opened formal proceedings against Shein under the Digital Services Act concerning its addictive design, the lack of transparency of its recommender systems, and the sale of illegal products; these are proceedings, not findings of infringement.
Apple's App Store privacy label for the SHEIN iOS app, as self-reported by the developer, discloses that identifiers may be used to track users across apps and websites owned by other companies.
On September 1, 2025, France's data protection authority (CNIL) fined Infinite Styles Services Co. Limited, the Irish subsidiary of the Shein group, 150 million euros for placing cookies on users' devices without consent, not respecting user choices, and not properly informing users on the shein.com website.
Shein's US Privacy Policy (effective March 31, 2026) discloses the use of cookies, tags, web pixels, and similar technologies to automatically collect information, including conversion pixels and third-party analytics and social media advertising providers.