AliExpress is the cross-border consumer marketplace of Alibaba Group Holding Limited (NYSE/HKEX: BABA), operated for U.S. buyers by AliExpress E-Commerce One Pte. Ltd. Its own privacy policy discloses broad account, order, and "general personal information" collection -- including optional body-shape and body-measurement data for sizing -- plus automatic collection of device identifiers, IP addresses, and browsing behavior that feeds derived preference profiles; it names Google, X, Facebook, Instagram, Appsflyer, and Criteo as marketing/analytics partners and self-declares a CCPA "share" of identifiers, usage data, and inferences with advertising networks, analytics providers, platforms, and social networks. Apple's App Store privacy label confirms Identifiers are used to track users across other companies' apps and sites, and that Payment Info, Precise Location, and Contact Info are collected and linked to identity. Corporate ownership is traceable through Alibaba's mandatory SEC 20-F filing, which discloses AliExpress as part of its International Digital Commerce Group but also discloses that Alibaba's Cayman Islands holding-company structure relies on China-based variable interest entities (VIEs) in which shareholders "do not own any equity interests." The European Commission opened formal Digital Services Act proceedings against AliExpress in March 2024 covering risk management, content moderation, ad/recommender transparency, trader traceability, and researcher data access; on June 18, 2025 the Commission accepted binding commitments from AliExpress resolving all but one area of concern while preliminarily finding it in breach of its obligation to assess and mitigate risks from the dissemination of illegal products, and on July 20, 2026 the Commission fined AliExpress €550 million for breaching those risk-assessment and mitigation obligations, per Alibaba's own SEC Form 20-F and the Commission's own announcements.
TRACK RECORD
2 ENFORCEMENT ACTIONS
[2026-07-20]
The European Commission's own press release of July 20, 2026 states the Commission "fined AliExpress €550 million for breaching its obligations under the Digital Services Act (DSA) to diligently assess and mitigate risks relating to the sale of illegal, unsafe or counterfeit products on its e-commerce platform," ordered the platform to take action, and states that failure to comply with the non-compliance decision may lead to periodic penalty payments.
The European Commission's Digital Services Act page confirms it opened formal proceedings against AliExpress in March 2024 to assess potential breaches related to risk management and mitigation, content moderation and internal complaint handling, transparency of advertising and recommender systems, trader traceability, and researcher data access.
Apple's App Store privacy label for the AliExpress app discloses that Payment Info, Precise and Coarse Location, and Contact Info (physical address, email address, name, phone number) are collected and linked to the user's identity to support 'App Functionality.'
As assessed by PrivacySpy on 2020-12-11 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the service collect personal data from third parties? — Yes, but for critical data only.
AliExpress's privacy policy discloses that, in addition to standard account, order, and payment data, it optionally collects general personal information that cannot identify a user, such as body shape and body measurements, to support clothing-size recommendations and fit prediction.
As assessed by PrivacySpy on 2020-12-11 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy outline the service's general security practices? — Somewhat.
Alibaba Group Holding Limited's SEC Form 20-F discloses AliExpress as part of its International Digital Commerce Group and identifies itself as a Cayman Islands-incorporated registrant, but also discloses that China-regulated portions of its business are operated through variable interest entity (VIE) contractual arrangements in which Alibaba's shareholders hold no direct equity interest.
As assessed by PrivacySpy on 2020-12-11 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy allow personally-targeted or behavioral marketing? — Yes, but you may opt-out.
AliExpress's privacy policy self-declares a CCPA 'share' of certain identifiers (IP address, online identifiers), usage data, and inferences with advertising networks, data analytics providers, operating systems and platforms, and social networks, while stating it does not disclose personal information to third parties for monetary compensation.
As assessed by PrivacySpy on 2020-12-11 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy require users to be notified in case of a data breach? — Yes, eventually.
The European Commission's Digital Services Act page confirms it opened formal proceedings against AliExpress in March 2024 to assess potential breaches related to risk management and mitigation, content moderation and internal complaint handling, transparency of advertising and recommender systems, trader traceability, and researcher data access.
Alibaba Group's SEC Form 20-F for fiscal year 2026 (filed May 2026) discloses that on June 18, 2025 the European Commission accepted commitments by AliExpress "to resolve all but one of the EU Commission's areas of concerns regarding its platform," and that on the remaining area the Commission "issued preliminary findings that AliExpress is in breach of its obligation to assess and mitigate risks related to the dissemination of illegal content on its platform, such as counterfeit goods or goods that do not comply with European safety rules," with the preliminary findings stated to be without prejudice to the investigation's final outcome.
The European Commission's own press release of July 20, 2026 states the Commission "fined AliExpress €550 million for breaching its obligations under the Digital Services Act (DSA) to diligently assess and mitigate risks relating to the sale of illegal, unsafe or counterfeit products on its e-commerce platform," ordered the platform to take action, and states that failure to comply with the non-compliance decision may lead to periodic penalty payments.
Apple's App Store privacy label for the AliExpress app discloses that Identifiers data may be used to track users across apps and websites owned by other companies.
AliExpress's privacy policy names its marketing, advertising, and behavioral-analytics partners, including Google, X, Facebook, Instagram, Appsflyer, and Criteo, stating these partners may combine data collected on the AliExpress platform with data from their own platforms and other sources for targeted advertising.