AliExpress (Alibaba Group)
- Complaint filed
- 28.03.2026
- Decision
- 28.04.2026
- Time to decision
- 31 days
- Decision number
2.1-1/26/642-1328-2- GDPR articles
- 12, 15
1a5d108e6bb8e3e79712f248516765118350f70ee94e18186e55d3a32a59f029The document is published in full. The complainant's personal data (email address) has been removed from the document.
Grounds for refusal
- no means of enforcement (third country)
What was in the complaint
The key argument: the Member ID — a unique account identifier that does not depend on a change of email. The complainant presented a Member ID + three Order IDs + payment card details. More than enough to establish identity. AliExpress refused to accept it.
Art. 12(1) — obstruction of access. AliExpress four times (10, 10, 13, 18 March) demanded that the request be sent strictly from one specific personal email address. No alternative method of identity confirmation was ever offered — even though the complainant provided screenshots of three orders with amounts and card details, an order report, the Member ID and card details.
Articles: 11(2), 12(1), 12(2), 12(3), 15(1).
What AKI decided
Proceedings discontinued. Grounds: Art. 57(1)(f); “resolve it yourself”; the unreachability of the controller.
Analysis
Here the breach is in the method of identity verification. AliExpress rigidly tied the right of access to one specific email address and refused to consider any other evidence.
But Art. 11(2) and the logic of the GDPR expressly allow identification by any sufficient data. A Member ID unambiguously identifies the account regardless of email; the card details and Order IDs confirm it. To require, on top of that, a letter from exactly one pre-specified address is an artificial barrier, not a security measure.