Microsoft researchers caught Shein's Android app red-handed: version 7.9.2 was silently reading your clipboard — every URL, every price, every password you'd copied — testing if it contained "://" and "$", then packaging whatever it found and shipping it to a remote server. Sophos published the findings, calling the app "rogue." You might have copied a bank password, a private message, or a medical result. Shein's app was reading all of it, all the time, and sending it to their servers. A shopping app had no business touching your clipboard, let alone exfiltrating its contents. In 2018, hackers stole data from 39 million Shein customers. The company told the public only 6.4 million were affected — a lie by a factor of six. Worse, Zoetop (Shein's parent) already knew credit card data had been stolen when it published a press release claiming "no credit card information was taken." It waited 45 days to tell even the fraction it acknowledged. New York's Attorney General fined them $1.9 million. That means 32.6 million people whose data was stolen were never told. They may still not know.
What they claim: Shein's privacy policy states it collects data necessary to provide its shopping service.
What we found: Microsoft researchers found Shein's Android app version 7.9.2 silently reading clipboard contents, testing for URLs with prices, packaging clipboard data into POST requests sent to a remote server. Passwords, bank details, private messages — all read and potentially exfiltrated. Sophos called it rogue behavior.
What they claim: Shein claims to provide a safe, secure shopping experience and takes privacy seriously.
What we found: Class action settlement of $75 million received final approval December 2025 for privacy violations spanning 2018-2024. Combined with $1.9M NY fine, EUR150M CNIL fine, and ongoing Texas lawsuit, privacy bill exceeds $250 million.
What they claim: Shein provides users with meaningful cookie consent choices.
What we found: France's CNIL fined Shein EUR150 million in September 2025. Advertising cookies were placed the instant users visited shein.com — before consent. Clicking Refuse all did nothing: new cookies kept being placed, existing ones continued. Affected 12 million monthly French visitors.
What they claim: Shein claims to store user data in the US and Singapore with appropriate protections.
What we found: Shein operates through Roadget Business Pte Ltd (Singapore shell) while founded in Nanjing, China. Texas AG alleged Shein fails to disclose data may be accessible to the Chinese government. Texas Governor Abbott added Shein to the Prohibited Technologies List in January 2026. The FBI warned about Chinese-owned apps in March 2026.
What they claim: Shein's privacy policy does not disclose that consumer data may be accessible to the Chinese government.
What we found: In May 2026, the Irish Data Protection Commission opened a formal investigation into Shein's transfer of customer data to China under GDPR. In February 2026, Texas AG sued Shein for failing to disclose that Chinese national intelligence laws can compel data access, calling the omission "material and deceptive."
What they claim: Shein (Zoetop) claimed the 2018 data breach affected 6.4 million customers and no credit card data was taken.
What we found: New York found the breach actually affected 39 million customers — six times more than disclosed. Zoetop already knew credit cards were stolen when it published a press release claiming otherwise. Waited 45 days to notify even the reduced number. NY AG fined Zoetop $1.9 million. 32.6 million people were never informed their data was stolen.
What they claim: Shein claims products meet safety standards and are safe for consumers.
What we found: Texas AG's February 2026 lawsuit alleged Shein sells clothing with toxic chemicals including lead at levels exceeding legal limits. Independent labs found lead at 20 times the safe limit and PFAS forever chemicals. California Proposition 65 violations documented.
What they claim: Shein provides cookie consent mechanisms for EU users
What we found: CNIL fined Shein €150 million after finding the "Reject All" button on shein.com did not actually reject tracking cookies. Clicking "Reject All" left cookies in place. 12 million monthly French visitors were tracked even after explicitly refusing. Shein is appealing.
What they claim: Shein claims to uphold ethical labor standards and supply chain transparency.
What we found: UK parliamentary inquiry investigated forced labor. Channel 4 found workers earning 3 pence per garment in 18-hour days. Shein flew influencers to a staged factory tour in June 2023 which backfired when viewed as propaganda. Independent audits found consistent labor violations.
What they claim: Shein's website presents a cookie consent banner to European users.
What we found: France's CNIL fined Shein €150 million for placing tracking cookies before users interacted with the consent banner. Even after users clicked "Refuse all," new cookies were still placed. 12 million monthly French visitors were affected. The cookie banner existed. It didn't work. Clicking "refuse" didn't refuse. The consent mechanism was decoration — cookies were placed regardless of what button you pressed. CNIL found cookies loading before the banner appeared, meaning tracking began before you had a chance to object.