Shein generates and stores a unique identifier for your browser session, called a 'cookieId' or 'OEST' token, which persists in both cookies and localStorage to track you across visits.
This analysis describes what Shein's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This persistent cross-session identifier enables Shein to link your browsing activity across multiple visits, which may constitute personal information under privacy laws and requires disclosure and, in some jurisdictions, consent.
Interpretive note: The full scope of data associated with the OEST identifier and its retention or deletion upon consent withdrawal cannot be determined from the document source alone.
Previously, Shein asked users to explicitly agree or disagree with account persistence for future logins. The updated terms remove this choice entirely. Instead of a consent decision, users now see a…
A unique tracking token tied to your browser is created and stored in multiple locations (cookies and localStorage) when you visit Shein, enabling tracking of your behavior over time across visits to the site.
How other platforms handle this
We use cookies and similar tracking technologies to track the activity on our websites and services and store certain information. Tracking technologies used include beacons, tags, and scripts to collect and track information and to improve and analyze our services. You can instruct your browser to ...
American gets this information by using technologies, including cookies, web beacons, and mobile device geolocation to provide and improve our Interactive Services and advertising, including across browsers and devices (also known as cross-device linking). This technical information may be combined ...
We use cookies, web beacons, pixel tags, and other tracking technologies to collect information about your use of our Services. This information may include your IP address, browser type, operating system, referring URLs, and information about how you interact with our Services.
Monitoring
Shein has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 10 platforms.
"var D = _(); // cookieId derived from base64-decoded 'Y29va2llSWQ=' ... window.GLOBAL_SN_OEST.init({ ssrOest: "MUExQjVBNjlfNDY0N18zMEY0fDE3Nzc2NTI5ODA0MzZ8X0ZCMDhfQ0I3REMyMzI4QzBC", shouldSetCC: true, useCC:true, i18nKey: "Curve + Plus" });— Excerpt from Shein's Shein Terms and Conditions
REGULATORY LANDSCAPE: Persistent browser identifiers constitute personal information or personal data under CCPA, CPRA, and GDPR where they can be linked to an individual's browsing behavior. The FTC Act and applicable state privacy laws govern the use and disclosure of such identifiers. The ePrivacy Directive (EU Cookie Law) requires informed consent before storing non-essential tracking identifiers in the EU. GOVERNANCE EXPOSURE: Medium. The OEST system stores identifiers in both cookie storage and localStorage ('window.localStorage.setItem(M, ...)'), and the SDK configuration disables localStorage interception ('enableInterceptStorageList: false'). This means the consent management system may clear cookies upon opt-out but leave the localStorage-based identifier intact, creating a persistence gap that could undermine the effectiveness of user consent withdrawal. JURISDICTION FLAGS: California residents have the right to know about and request deletion of personal information including persistent identifiers under CCPA/CPRA. EU/EEA users require affirmative consent before non-essential identifier storage under GDPR and the ePrivacy Directive. The dual-storage approach (cookie plus localStorage) heightens exposure in jurisdictions with comprehensive cookie consent requirements. CONTRACT AND VENDOR IMPLICATIONS: The OEST token is transmitted server-side via the 'x-oest' header in a fetch call to Shein's BFF (backend for frontend) API, meaning the identifier flows beyond the browser to Shein's backend systems. Vendor and data processing agreements should account for this server-side identifier transmission. COMPLIANCE CONSIDERATIONS: Compliance teams should audit whether the localStorage-based OEST identifier is cleared when a user withdraws consent or requests deletion, given that the SDK configuration explicitly disables localStorage interception. A consent mechanism review should confirm that this identifier is categorized appropriately (analytics vs. functional vs. advertising) in the cookie consent interface and that its retention period is disclosed.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Watcher: 10 platforms + same-day alerts. No credit card required.
Netflix updated its Privacy Statement on April 18, 2026, disclosing voice recording collection and expanded household ad profiling for the first time.
Google's Privacy Policy covers Search, Gmail, YouTube, Maps, and every site running Google Analytics. Here is what it actually authorizes.
Professional Governance Intelligence
Need to monitor specific governance provisions?
Professional includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This persistent cross-session identifier enables Shein to link your browsing activity across multiple visits, which may constitute personal information under privacy laws and requires disclosure and, in some jurisdictions, consent.
A unique tracking token tied to your browser is created and stored in multiple locations (cookies and localStorage) when you visit Shein, enabling tracking of your behavior over time across visits to the site.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Shein.