Shein generates and stores a unique identifier for your browser session, called a 'cookieId' or 'OEST' token, which persists in both cookies and localStorage to track you across visits.
This analysis describes what Shein's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This persistent cross-session identifier enables Shein to link your browsing activity across multiple visits, which may constitute personal information under privacy laws and requires disclosure and, in some jurisdictions, consent.
Interpretive note: The full scope of data associated with the OEST identifier and its retention or deletion upon consent withdrawal cannot be determined from the document source alone.
Previously, Shein asked users to explicitly agree or disagree with account persistence for future logins. The updated terms remove this choice entirely. Instead of a consent decision, users now see a promotional discount offer in that location. This means users lose direct control over whether Shein maintains their login session across device visits, which affects convenience and privacy preferences around authentication persistence.
View change record →Removal of explicit base64-decoded cookieId variable initialization may indicate refactoring of session identifier generation, though OEST functionality continues in modified form.
View full change record →A unique tracking token tied to your browser is created and stored in multiple locations (cookies and localStorage) when you visit Shein, enabling tracking of your behavior over time across visits to the site.
How other platforms handle this
We use cookies and similar tracking technologies (collectively, "Cookies") to enhance your experience on our Platform... We may use Cookies for purposes such as recognizing you when you log in, remembering your preferences, delivering advertising to you on third-party websites, understanding how you...
At Ledger, earning and maintaining our users' trust is a top priority. That's why we are deeply committed not only to protecting your privacy and securing your personal data, but also to being fully transparent about how we handle it.
If you are located in the European Economic Area, Switzerland, or the United Kingdom, you have the right to access, correct, or erase your personal data; the right to restrict or object to our processing of your personal data; the right to data portability; and, where our processing is based on your...
Monitoring
Shein has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"var D = _(); // cookieId derived from base64-decoded 'Y29va2llSWQ=' ... window.GLOBAL_SN_OEST.init({ ssrOest: "MUExQjVBNjlfNDY0N18zMEY0fDE3Nzc2NTI5ODA0MzZ8X0ZCMDhfQ0I3REMyMzI4QzBC", shouldSetCC: true, useCC:true, i18nKey: "Curve + Plus" });— Excerpt from Shein's Shein Terms and Conditions
REGULATORY LANDSCAPE: Persistent browser identifiers constitute personal information or personal data under CCPA, CPRA, and GDPR where they can be linked to an individual's browsing behavior. The FTC Act and applicable state privacy laws govern the use and disclosure of such identifiers. The ePrivacy Directive (EU Cookie Law) requires informed consent before storing non-essential tracking identifiers in the EU. GOVERNANCE EXPOSURE: Medium. The OEST system stores identifiers in both cookie storage and localStorage ('window.localStorage.setItem(M, ...)'), and the SDK configuration disables localStorage interception ('enableInterceptStorageList: false'). This means the consent management system may clear cookies upon opt-out but leave the localStorage-based identifier intact, creating a persistence gap that could undermine the effectiveness of user consent withdrawal. JURISDICTION FLAGS: California residents have the right to know about and request deletion of personal information including persistent identifiers under CCPA/CPRA. EU/EEA users require affirmative consent before non-essential identifier storage under GDPR and the ePrivacy Directive. The dual-storage approach (cookie plus localStorage) heightens exposure in jurisdictions with comprehensive cookie consent requirements. CONTRACT AND VENDOR IMPLICATIONS: The OEST token is transmitted server-side via the 'x-oest' header in a fetch call to Shein's BFF (backend for frontend) API, meaning the identifier flows beyond the browser to Shein's backend systems. Vendor and data processing agreements should account for this server-side identifier transmission. COMPLIANCE CONSIDERATIONS: Compliance teams should audit whether the localStorage-based OEST identifier is cleared when a user withdraws consent or requests deletion, given that the SDK configuration explicitly disables localStorage interception. A consent mechanism review should confirm that this identifier is categorized appropriately (analytics vs. functional vs. advertising) in the cookie consent interface and that its retention period is disclosed.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This persistent cross-session identifier enables Shein to link your browsing activity across multiple visits, which may constitute personal information under privacy laws and requires disclosure and, in some jurisdictions, consent.
A unique tracking token tied to your browser is created and stored in multiple locations (cookies and localStorage) when you visit Shein, enabling tracking of your behavior over time across visits to the site.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Shein.