Is Shein Safe in 2026? Answer Depends on Which Risk You’re Asking About

Is Shein Safe in 2026?

Quick Answer

Is Shein safe to pay on? Mostly yes — it uses standard TLS encryption, and your card details are not floating unprotected.

Is Shein safe for your personal data? No. The app collects far more data than shopping requires, the company has a documented history of both breaching user data and lying about the scale of that breach, and a 2023 incident caught the Android app transmitting clipboard contents — including passwords and bank details — to a remote server.

Is Shein safe for the products themselves? Not for children. Independent lab testing found PFAS (forever chemicals) in Shein jackets at concentrations up to 3,300 times the EU safety limit. South Korean regulatory testing found phthalates in children’s shoes at 428 times the legal limit. In February 2026, the Texas Attorney General filed a civil lawsuit calling Shein’s products “silent carriers of poison.”

These are three different questions with three different answers. Every competing article on this topic collapses them into one vague answer — and most of those articles are published by VPN companies with a financial interest in saying “generally safe, just buy our product.” This article has no VPN to sell you.

Why Every “Is Shein Safe” Article Has a Conflict of Interest

Before the analysis: the first page of Google results for “Is Shein safe” in 2026 is dominated by articles from PrivadoVPN, AstrillVPN, Surfshark, ExpressVPN, and NordVPN. Every one of these companies sells a VPN subscription. Every one of their articles concludes with a recommendation to use their product while shopping on Shein.

This creates a structural incentive to rate Shein as “generally safe but risky enough to need a VPN.” A verdict of “Shein is completely unsafe, stop using it” sells no subscriptions. A verdict of “Shein is fine, no concerns” also sells no subscriptions. “Safe enough if you use our VPN” is the commercially optimal answer regardless of the evidence.

BitsFromBytes does not sell VPNs. Our verdict below is based on primary sources: the Texas AG lawsuit filing, New York AG enforcement records, the ESET security blog’s documented technical findings, Greenpeace Germany’s lab test results, and NIST’s cybersecurity guidance on third-party app risk.

The BitsFromBytes 3-Dimension Shein Safety Scorecard

No other “Is Shein Safe” article in the current SERP separates these three dimensions. They require different assessments because the evidence is different for each.

Cite as: BitsFromBytes Research, Shein 3-Dimension Safety Scorecard, May 2026.

Dimension 1: Payment Security ✅

Shein’s website and app use HTTPS with TLS encryption — the same standard used by Amazon, Target, and every major e-commerce retailer. The platform accepts credit cards, debit cards, PayPal, Apple Pay, and Google Pay. Using PayPal or Apple Pay adds an additional layer by preventing Shein from directly receiving your card number.

The payment infrastructure itself is not the problem. Two important caveats:

Caveat 1 — The 2018 breach included payment data. Shein’s parent company Zoetop confirmed in its New York AG settlement that the 2018 breach exposed “credit card details” for some affected accounts. The breach itself is not ongoing — it is a historical event. But it establishes that Shein has previously failed to protect payment data when its backend systems were compromised.

Caveat 2 — Secure checkout doesn’t protect against account takeover. If your Shein account password is weak or reused from another site, and that other site has been breached, an attacker could access your saved payment methods through your Shein account. This is a general e-commerce risk, not Shein-specific.

Practical guidance: use a virtual card number (available through most major U.S. banks) or PayPal for purchases. Do not save your primary card to your Shein account.

Dimension 2: Data Privacy & App Security ❌

This is where Shein’s safety record becomes genuinely concerning, and where the evidence is strongest.

The 2018 Breach: What Actually Happened

In 2018, hackers infiltrated the backend systems of Zoetop (then Shein’s and Romwe’s parent company) and extracted personal information for a large number of customers. Zoetop’s initial public response claimed approximately 6.42 million accounts were affected.

The New York Attorney General’s 2022 investigation found the true number was 39 million Shein accounts and 7 million Romwe accounts — six times the number Shein had disclosed. The AG’s investigation revealed aggravating factors: Zoetop had failed to salt password hashes (a basic security practice), did not conduct a full forensic investigation after discovering the breach, and sent breach notification emails only to the 6.42 million users it had publicly acknowledged, leaving 33 million users uninformed for years. New York fined Zoetop $1.9 million — widely criticized as insufficient given the scale.

The 2023 Clipboard Bug

In 2023, security researchers documented that the Shein Android app (version 7.9.2) periodically captured and transmitted clipboard contents to a remote server. The clipboard is where your device temporarily stores copied text — including passwords copied from password managers, bank account numbers, and two-factor authentication codes. Shein attributed the behavior to a legacy component and released an update. The incident is factual and documented by multiple independent security researchers.

App Permissions: What Shein Collects

The current Shein app requests or collects (depending on platform and version):

• Device identifiers, hardware specs, and operating system details
• Browsing and search behavior within the app
• Location data (when granted)
• Behavioral analytics beyond standard shopping activity
• Cross-app tracking data where permitted by the OS

None of these individually are unusual for a major retail app. The combination, governed by Shein’s privacy policy under Chinese law and Singapore corporate structure, is the concern. Under China’s 2021 Data Security Law and 2021 Personal Information Protection Law, Chinese authorities have the legal authority to compel data access from companies with Chinese operations or ownership — and Shein’s operational and ownership links to China remain despite its Singapore headquarters.

January 2026: Texas Adds Shein to Prohibited Technologies List

In January 2026, Texas Governor Greg Abbott added Shein to the state’s Prohibited Technologies List — the same list that includes TikTok — restricting the app from state-owned devices. The Texas AG’s February 2026 lawsuit filing cites this designation as evidence of broader data security concerns, specifically alleging that consumer data collected by Shein may be accessible to Chinese government entities.

Shein denies these allegations. The lawsuit is ongoing as of May 2026.

The Shein Legal Timeline: What Every Buyer Should Know

This timeline is compiled from primary sources and does not appear in this consolidated form in any competing article.

Dimension 3: Product Chemical Safety ❌ (Especially for Children)

The chemical safety dimension has the most alarming data in 2026, and it is the dimension most consistently underreported in the articles currently ranking for this keyword.

What the Texas Lawsuit Alleges

On February 20, 2026, Texas AG Ken Paxton filed a civil lawsuit against Shein US Services, LLC in Collin County District Court, alleging violations of the Texas Deceptive Trade Practices Act. The filing describes Shein’s products as “silent carriers of poison” and makes specific, source-cited chemical allegations:

• PFAS (“forever chemicals”) in outerwear: Greenpeace Germany’s 2025 lab tests found PFAS in seven Shein jackets at concentrations up to 3,300 times the EU limit
• Phthalates in children’s products: South Korean regulatory testing found phthalate levels in some Shein children’s shoes and accessories at up to 428 times the legal limit
• Lead and formaldehyde in children’s clothing and accessories

The Seoul Metropolitan Government testing context: investigators tested 93 Shein products and found approximately half contained hazardous chemical levels, per court filing references and Environment+Energy Leader’s reporting on the lawsuit.

Shein has denied the toxic product claims. The lawsuit is ongoing.

What Independent Testing Has Found

The Texas lawsuit relies substantially on independent testing that predates the litigation:

Greenpeace Germany (late 2025): Seven Shein jackets tested; all seven contained PFAS. Maximum concentration: 3,300× the EU limit. PFAS are called “forever chemicals” because they do not break down in the human body or the environment. Documented health associations include thyroid disruption, immune system effects, and increased cancer risk at sufficient exposure levels, per EPA PFAS research.

South Korean government testing: Phthalates (plastic softeners linked to hormonal disruption and developmental effects in children) found at 428× the legal limit in children’s footwear. Phthalates are regulated in children’s products in both the EU and the U.S. under CPSC guidelines.

Snopes fact-check (April 2026): Snopes rated the formaldehyde-in-Shein-products claim as TRUE, confirming that Texas AG testing found formaldehyde in children’s clothing at levels exceeding non-U.S. regulatory standards.

The BitsFromBytes Chemical Risk Summary

Who faces the highest risk: children, pregnant women, and people with frequent skin contact with Shein’s synthetic-fabric items. The Texas lawsuit specifically focuses on these groups. Adults wearing Shein clothing occasionally face lower documented risk — the concern is concentration through frequent or prolonged contact with chemically treated textiles.

Cite as: BitsFromBytes Research, Shein Chemical Risk Summary Table, May 2026.

What Shein Says

Shein has responded to the Texas lawsuit through a spokesperson statement: “At SHEIN, we take our responsibilities to our customers seriously and we are committed to providing a safe, secure, and reliable shopping experience. Like Attorney General Paxton, we are dedicated to protecting the health and personal information of Texans and all of our customers, and remain focused on maintaining our high standards for product safety.”

Shein also states it complies with applicable safety standards in each market it operates in and that it has invested in quality testing infrastructure. The company has not addressed the specific chemical concentration figures cited in the Texas lawsuit as of May 2026.

Practical Guidance: What to Do Based on Your Risk Tolerance

If you shop on Shein and want to minimize data risk:

• Use the web browser version at shein.com rather than the app — browser shopping reduces device-level data collection
• Do not install the app on a device that also stores sensitive information
• Use a virtual card number or PayPal — never save your primary credit card to the account
• Use a unique password for your Shein account that is not reused anywhere else
• Deny all non-essential permissions if you use the app (location, microphone, contacts)

If you buy Shein clothing for children:

• Wash all items multiple times before first wear — hot-water washing reduces but does not eliminate surface chemical residue
• Avoid purchasing jackets, outerwear, or synthetic accessories for children or pregnant women specifically given the PFAS and phthalate findings
• The chemical risk findings are concentrated in children’s products and synthetic outerwear — adult casual clothing in natural fibers carries lower documented risk

If you are a Texas resident:

• The Texas AG lawsuit is seeking a temporary restraining order that would prohibit Shein from collecting and sharing Texas consumers’ data during litigation. Follow the case status at the Texas OAG website — if the TRO is granted, it changes the practical data privacy picture for Texas residents.

Alternatives to Shein

If Shein’s data practices or product safety record are dealbreakers, these alternatives offer similar price accessibility with stronger regulatory track records:

OEKO-TEX Standard 100 certification — available on Uniqlo’s certified products and some H&M lines — is the most reliable independent indicator that a textile has been tested for harmful substances at every production stage. You can verify certification status at oeko-tex.com.

Frequently Asked Questions

Is Shein safe to use in 2026?

The answer depends on which risk you mean. Payment security: yes, Shein uses standard TLS encryption and accepts major payment processors. Data privacy: no — the app collects extensive behavioral data governed partly by Chinese law, the company was fined for hiding a 39 million-account data breach, and the Android app was caught transmitting clipboard data in 2023. Product chemical safety: high risk for children’s products, based on Texas AG lawsuit evidence citing PFAS at 3,300× the EU limit and phthalates at 428× the legal limit.

Has Shein had a data breach?

Yes. In 2018, Shein’s then-parent company Zoetop was breached, exposing data for 39 million Shein accounts and 7 million Romwe accounts. Shein initially claimed only 6.42 million accounts were affected. The New York Attorney General’s 2022 investigation revealed the true figure was six times higher, fining the company $1.9 million. Additionally, in 2023, the Shein Android app (version 7.9.2) was found transmitting clipboard data — including potentially passwords and banking information — to a remote server.

Is Shein being sued in 2026?

Yes. On February 20, 2026, Texas Attorney General Ken Paxton filed a civil lawsuit against Shein US Services, LLC in Collin County District Court. The lawsuit alleges violations of the Texas Deceptive Trade Practices Act on two grounds: (1) selling products with dangerous levels of toxic chemicals including PFAS, phthalates, lead, and formaldehyde, and (2) misrepresenting consumer data practices and allegedly exposing user data to Chinese government access. The lawsuit seeks a temporary restraining order, injunctions, and civil penalties of up to $10,000 per violation.

Is Shein safe for children’s clothing?

Based on available evidence: exercise caution. Greenpeace Germany’s 2025 lab tests found PFAS in Shein jackets at up to 3,300 times the EU safety limit. South Korean regulatory testing found phthalates in children’s shoes at up to 428 times the legal limit. Both findings are cited in the Texas AG’s February 2026 lawsuit. Shein denies these allegations. If you purchase Shein children’s clothing, wash it multiple times before first wear and avoid jackets and synthetic accessories specifically.

Is it safe to use a credit card on Shein?

For the transaction itself: yes, Shein uses HTTPS/TLS encryption. For long-term safety: use a virtual card number or PayPal rather than saving your primary card to your account. Shein’s 2018 breach exposed some payment data. Using a disposable virtual card number (available through most major U.S. banks) limits your exposure to a single transaction amount.

Why is Shein on Texas’s Prohibited Technologies List?

In January 2026, Texas Governor Greg Abbott added Shein to the state’s Prohibited Technologies List, which restricts the app on state-owned devices. Texas cites concerns about data security and the potential for consumer data to be accessed by Chinese government entities, given Shein’s operational and historical ties to China. The same list includes TikTok. The designation does not restrict private consumer use; it applies only to government-owned devices.

Is Shein banned in the US?

No. As of May 2026, Shein is not banned in the United States at the federal level. It is restricted on government devices in Texas. The Texas AG lawsuit is civil litigation, not a ban. Several federal lawmakers have called for broader scrutiny of Chinese-linked apps, but no federal legislation restricting consumer access to Shein had passed as of this article’s last update.