WHAT THE POLICIES SAY

Alibaba Group Holding Limited is a Cayman Islands-incorporated holding company headquartered in Hong Kong, listed on the New York Stock Exchange and (per its SEC 20-F) operating parts of its China business through variable interest entities (VIEs) rather than direct equity ownership, which it discloses as a structural risk factor. Alibaba's own group-level privacy policy states it will not share personal information with outside parties except for specified circumstances (affiliates, legal process, consent), and discloses standard cookie use limited to site security and crash detection, with data stored on AliCloud servers in mainland China. Its consumer marketplace AliExpress (published separately at composite 30 in this catalogue) is the subject of formal European Commission proceedings under the Digital Services Act; the EU Commission issued preliminary findings in 2025 that AliExpress breached its obligation to assess and mitigate the spread of illegal content, an unresolved matter as of the filing. No data-privacy-specific breach or PIPL/CAC enforcement order against the parent was found in this research.

TRACK RECORD

1 ENFORCEMENT ACTION

[2026-05-20]

Alibaba's 20-F discloses that the European Commission opened formal proceedings in March 2024 against AliExpress (Alibaba's consumer marketplace) to assess compliance with the EU Digital Services Act, and that in 2025 the Commission accepted commitments resolving most concerns but issued preliminary findings that AliExpress remains in breach of its obligation to assess and mitigate risks of illegal content such as counterfeit goods, an investigation not yet finally resolved. This is a content-moderation / counterfeit-goods matter under the EU Digital Services Act, not a privacy or data-protection incident -- no fine, order, or finding concerning personal-data handling was found in this research.

sec.gov ↗

TIMELINE

NO ENTRIES ON FILE YET.

ULTIMATE PARENT

Alibaba

THIS FILE HEADS ITS OWN CHAIN.

SUBSIDIARIES ON FILE (2)

TOOLS WE RECOMMEND

PLUS

RECEIPTS

10 ON FILE

[2022-08-29] · COLLECTION

Alibaba Group's website privacy policy states it collects personal information users provide directly (name, phone/fax number, email, address, employer, user type, inquiry details, etc.) when using alibabagroup.com, and separately defers to per-product privacy policies for any other Alibaba product or service.

alibabagroup.com ↗

[2024-11-08] · COLLECTION

The service's policy indicates information is provided about how your personal data is used.

rule.alibaba.com ↗

[2024-11-08] · OWNERSHIP TRANSPARENCY

The service's policy indicates the court of law governing the terms is in a jurisdiction that is less friendly to user privacy protection.

rule.alibaba.com ↗

[2026-05-20] · OWNERSHIP TRANSPARENCY

Alibaba Group Holding Limited's SEC Form 20-F annual report states the registrant is incorporated in the Cayman Islands, headquartered at 26/F Tower One, Times Square, Causeway Bay, Hong Kong, and lists its American Depositary Shares as registered for trading on the New York Stock Exchange; the same filing discloses that Alibaba's structure includes variable interest entities (VIEs) and their subsidiaries used to operate parts of its China business where direct foreign ownership is restricted, rather than direct equity ownership of those entities.

sec.gov ↗

[2022-08-29] · SHARING

The privacy policy states as a baseline that Alibaba will not share personal information with outside parties except for four disclosed circumstances: sharing with affiliates limited to necessary purposes at the user's request, disclosure required by law enforcement or legal process, disclosure to investigate or prevent illegal activity or protect safety, and sharing with the user's consent.

alibabagroup.com ↗

[2024-11-08] · SHARING

The service's policy indicates information is gathered about you through third parties.

rule.alibaba.com ↗

[2024-11-08] · SHARING

The service's policy indicates your content can be licensed to third parties.

rule.alibaba.com ↗

[2024-11-08] · TRACK RECORD

The service's policy indicates you must report to the service any unauthorized use of your account or any breach of security.

rule.alibaba.com ↗

[2026-05-20] · TRACK RECORD

sec.gov ↗

[2022-08-29] · TRACKING TECH

The privacy policy states cookies are used primarily to ensure the secure and efficient operation of the website, confirm the security status of a user's session, and detect unusual conditions such as crashes and delays, and that the company will not use cookies for purposes beyond those described in the policy; cookie collection requires consent via a banner.

alibabagroup.com ↗

DATA SOURCES

ToS;DR

CC BY-SA · TOSDR.ORG ↗

Claims are summarized from these sources and may be edited from the original. Text adapted from a CC BY-SA source is shared under CC BY-SA.

LAST REVIEWED 2026-08-19 · METHODOLOGY v1.7