VKontakte (vk.com)
- Complaint filed
- 02.05.2026
- Decision
- 13.05.2026
- Time to decision
- 11 days
- Decision number
2.1-1/26/405-867-9
61683885b1b0b13f2e7526897566fbeff817a5cd182d54110e4e8a6b60d34119The document is published in full. The complainant's personal data (email address) has been removed from the document.
What was in the complaint
The initial complaint was filed on 2 March 2026, then supplemented with new evidence.
Canvas fingerprinting. The independent scanner Blacklight (a project of The Markup) confirmed that VK uses canvas fingerprinting on the profile page — a technique that identifies a device even with cookies blocked. The user is not notified of this (Art. 5(1)(a)).
Cross-platform synchronisation. A single identifier tmr_lvid was found simultaneously on vk.com, mail.ru, ok.ru and a third-party site — systematic tracking across platforms without consent. yandex.ru, ad.mail.ru and tns-counter.ru are also involved.
Transfer of an EU subject’s data to Russian companies. Data goes to tns-counter.ru (Mediascope, a Russian analytics company) — without a legal basis under Art. 6 and without safeguards under Art. 44.
Device fingerprinting. VK stores in cookies the screen resolution, window size, colour depth, browser identifiers and orientation.
What AKI decided
Proceedings discontinued. Grounds: Art. 57(1)(f); the controller is in a third country (Russia), there are no means of enforcement.
Analysis
Here the unreachability of the controller is most obvious: VK has neither a legal entity in the EU, nor assets, nor a representative. There is physically nothing with which to enforce a fine.
But the fact itself is documented: canvas fingerprinting was confirmed by an independent tool (Blacklight), not only by the complainant. The transfer of a European’s data to a Russian analytics company is recorded in the network traffic.