vk.com/vk.ru

Context

vk.com is the “VKontakte” social network. The controller named in the policy is OOO «V Kontakte», Saint Petersburg, Khersonskaya Street 12–14; for the purposes of the policy it is represented by the Cypriot entity MGL MY.COM (CYPRUS) LIMITED, Limassol. The data protection officer is dpo@corp.my.com. The platform is developed in-house: the response headers report the server name and the exact version of the runtime environment.

The capture: 450 requests, 31 nodes. Three hundred and seventy-eight requests to the site’s own infrastructure — the main domain, static nodes, the API, the event queue, image nodes — and 72 outward. The recording lasts 91.2 seconds. Taken on 21 March 2026. The session begins on the authorisation domain, passes through login and ends on the profile page.

The processing is described by seven documents: the privacy policy and the cookie policy in English, the license agreement, the site usage rules, the platform rules, and the information-protection principles in Russian.

Who data goes to directly

Mediascope, Mail.ru, AppTracer, vk-portal.net.

Delivery caveat

The analysis is built on a capture taken from Estonia. Of the 72 external requests, 20 were delivered, and among them three are substantive: the redirect to the authorisation domain, an image from a Mail.ru node, and the rejected preflight request to akashi.vk-portal.net. The rest — to Mediascope, the Mail.ru counter, AppTracer and stats.vk-portal.net — failed with a name-resolution error.

A check showed that the domains tns-counter.ru and top-fwz1.mail.ru do not resolve either through the system name server or directly through an independent public server: the answer in all cases is the absence of a name. The cause lies outside the capture device and is not established in a browser recording.

Hence the frame of the whole analysis. What is recorded is not the fact of data being received, but the fact of it being sent beyond the site’s own infrastructure. The addresses, parameters and initiators can be read from the recording in full: it is visible which script formed a request, to which recipient it is addressed and which fields are passed in it. Whether it arrived is a separate question and has no bearing on the site’s behaviour. In a jurisdiction where these domains are available, the same requests will be delivered.

Declared versus actual

The document describes a site without a single third-party recipient. The cookie policy is laid out in detail: four categories, about ninety names, each listed. And for each without exception the provider column reads vk.com. The targeting-cookie category consists of a single item. A reader of this document gets a picture of a closed system where nothing leaves the confines of the network.

The capture shows four external recipients. Mediascope — a request with the site identifier vksite_total, the client code and the address of the page being viewed right in the request path. Mail.ru — an attendance counter, an ad node and a static node, four domains. AppTracer — 22 requests over 91 seconds. The vk-portal.net nodes — sixteen requests with a device identifier.

Not one of these names appears in the cookie policy, nor in the privacy policy, nor in the five Russian-language documents. The closest is the wording in the information-protection principles about the VK Ads Pixel and VK Widgets technologies, but it describes collection on third-party sites, not transfer from one’s own.

The account identifier goes to the ad network as an open parameter. Clause 4.4 of the privacy policy is worded as a guarantee: the system is built so that a user’s information is not passed directly to third-party advertisers — the advertiser only selects the attributes of a target group. Clause 4.5 reinforces it: on list matching the advertiser sees the number of matches but not the matches themselves.

In the addresses of the requests to r3.mail.ru and ad.mail.ru the numeric account identifier stands as an ordinary request parameter, next to a signature and a device attribute. The second request additionally specifies the ad slot, a test number and a minimum display price — that is, it is an ad request tied to a specific account. The identifier in this network is a direct key: it opens the user’s page.

The basis is declared, the mechanism is absent. The processing table in the privacy policy contains twelve rows, and in row 6 — data obtained automatically via cookies — the legal basis is given as consent. Not legitimate interest, as in most of the other rows, but consent specifically.

There is no mechanism for obtaining it on the site. Across all 450 requests neither a consent-management platform nor a script with the corresponding signs was encountered. Section 4 of the cookie policy answers the question “how to refuse” with a single method — browser settings, with links to the help pages of four browsers, including Internet Explorer, support for which ended in 2022.

Crash collection begins before login. The first external request goes out at the 5972nd millisecond, when the user is still on the credential-entry page: the initiator is the script auth.js, the referer header points to the authorisation domain. The request body is 251 bytes. There are 22 such requests in the session in all, and they continue until the last second of the recording.

Protection is reduced to a single header. Of the whole set, the site sets only strict transport, and with a six-month term at that, without including subdomains and without a preload flag. There is no content security policy — on a social network where users publish arbitrary content this is a notable omission. There is no frame-embedding prohibition, no content-type-sniffing prohibition, no referrer policy. The response headers meanwhile reveal the server name and the platform version down to the build number.

Separately, on the transition between domains. On login the chain leads from the authorisation domain to the main one, then to the domain login.vk.ru with a 307 code and back. In the addresses of these transitions the authorisation hash, the refresh token and service signatures go in clear text, and the destination address is base64-encoded inside a parameter. Request addresses end up in server logs, browser history and, in the absence of a referrer policy, in the referer header of subsequent requests.

The documents diverge from one another. The privacy policy is dated 19 October 2023. The license agreement — 30 December 2016, and in it the social network is defined as located at the address VK.RU. The site usage rules — 8 April 2024, there both domains appear. The platform rules — 2 April 2026, the freshest document, but it is about the API for third-party developers.

Both English-language policies open with a caveat: they apply only to European Union users, others should refer to the policy of the relevant jurisdiction. A link to this second policy is contained in none of the seven documents.

Transfer to Russia is declared directly. Clause 6.1 provides for the transfer and storage of personal data outside the European Economic Area, including in Russia. Clause 6.2 acknowledges that data-protection laws in these countries may differ, and names as the measure reasonable cybersecurity measures and standard contractual clauses. No adequacy decision has been adopted in respect of Russia, and an assessment of the sufficiency of additional measures with respect to a jurisdiction with legislation on authorities’ access to data is not provided in the document.

Consent: what is proven and what is not

Proven: there is no consent mechanism on the site. Not a single request to a consent-management platform and not a single script with the corresponding signs across all 450 requests.

Proven: the external requests are formed and addressed. The addresses, parameters and initiators can be read from the recording. For each it is visible which script generated it: for AppTracer — auth.js, for Mediascope and the Mail.ru counter — the site’s error-handling script.

Proven: the account identifier is included in the address of the advertising requests. The parameter stands in the open, next to the request signature.

Not proven and not asserted: the receipt of data by the external recipients. Discussed in the delivery caveat above.

Not proven and not asserted: the state of cookies on the device. The cookie headers were removed from the published file during cleaning. All conclusions rest on the addresses, parameters, response codes and initiators.

Separately: during the capture the browser was sending the header DNT: 1. This had no effect on the composition and addressing of the requests.

Observation boundaries

The capture covers the login to the account and the profile page of the recording’s owner. The messages, communities and advertising-office sections were not included in it; the collection of phone-book contacts, camera and microphone data declared in the policy relates to the mobile applications and is not verified by a browser capture.

The observation records browser behaviour, not the internal workings of the services. Server-side processing, the composition of the stored data, contractual relationships with recipients and the actual geography of storage are not verified by a browser capture — and for a site of this scale that is the main part of the processing.

The file is published cleaned: the cookie headers, the response bodies and the owner’s profile name have been removed — the name replaced by a marker in 453 places, the device identifier abbreviated to an indication of its length. The numeric account identifier and the session tokens are not given in the analysis.

Response bodies are absent from the recording, so checks against the markup of the main page — consent-mode configuration, pixel calls, reading of device characteristics — are impossible with this file. The analysis is limited to the network level.

The identification of services rests on domains and address schemes: Mediascope — by tns-counter.ru and the path format with a site identifier; Mail.ru — by mail.ru and mradx.net; AppTracer — by apptracer.ru and the path api/crash/trackSession; the statistics nodes — by vk-portal.net.

Conclusion

VKontakte’s cookie policy is written more thoroughly than many: four categories, about ninety items by name. And for all ninety the provider is named as the site itself. It follows from the document that a visitor’s data does not leave the confines of the network.

The capture shows four external recipients that appear in none of the seven documents: the audience measurer Mediascope with a site identifier in the address, the Mail.ru counter and ad network, a crash-collection platform that starts while still on the password-entry page, and external-statistics nodes with a device identifier. In two requests to the ad network the numeric account identifier is passed as an ordinary parameter in the address — even though the policy guarantees in a separate clause that a user’s information is not passed to advertisers directly.

There is no consent mechanism, although the privacy policy itself names consent as the legal basis for data obtained via cookies; refusal is offered via browser settings, with a link to Internet Explorer among others. Of the protective headers one is set, and session tokens on the transition between domains go in clear text in the address. The documents are dated haphazardly, from December 2016 to April 2026, and name the main domain differently.

Remediation: name all external recipients with the fields passed and the purposes stated; exclude the transfer of the account identifier to the ad network, or bring clause 4.4 into line with the practice; introduce a consent mechanism corresponding to the basis declared in the processing table; do not start crash collection on the authorisation page; set a content security policy, a frame-embedding prohibition and a referrer policy; remove session tokens from request addresses; reduce the seven documents to a consistent set with unified dates and a single naming of the domain.