Headline: In July 2024 the Lithuanian State Data Protection Inspectorate (VDAI) fined Vinted UAB €2,385,276 for GDPR breaches including improper handling of access requests, profiling issues, and cross-border data-controller failings. Two years on, this campaign has collected 2,554 UK complaints showing the same pattern continues at greater scale.
Does UK GDPR still apply to a Lithuanian company?
Yes. Two overlapping legal frameworks apply to UK users:
- UK GDPR (extra-territorial scope): Under section 3(2A) of the Data Protection Act 2018, the UK GDPR applies to any controller established outside the UK that offers goods or services to UK data subjects, or monitors their behaviour. Vinted plainly does both. UK users can file complaints with the ICO.
- EU GDPR via lead supervisory authority: For cross-border processing, the lead authority is the regulator where the controller has its main establishment. Vinted UAB is Lithuanian, so the Lithuanian State Data Protection Inspectorate (VDAI, ada@ada.lt, vdai.lrv.lt) is the primary regulator with authority to investigate systemic issues.
Both routes can be used in parallel. The ICO will typically coordinate with the VDAI on cross-border matters.
The Articles that engage on a typical Vinted ban
Almost every case in our corpus of 2,554 UK complaints raises at least three of the following four articles.
Article 22: automated individual decision-making, including profiling
Article 22 gives users the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. Losing an account, listings, reputation and any wallet balance meets that threshold.
Vinted's own communications reference "our systems have detected" and "automated checks". The 68 ban-apologise-ban loops in our corpus, where an account is restored and re-banned within 24 to 72 hours for the same reason, indicate the Article 22(3) safeguard of "meaningful human intervention" is either absent or performative. Sellers report appeal decisions within seconds, sometimes at 03:00 local time, which is not consistent with human review.
Article 15: right of access
UK users have a right to know what personal data is held about them, why, and, where automated decision-making is used, "meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject" (Article 15(1)(h)). Vinted's typical Subject Access Request response is a JSON export of listings and messages, with no risk scores, no flag history, and no meaningful information about the logic.
Article 17: right to erasure
Where a user has requested deletion, our corpus documents profiles remaining live, listings reappearing under other accounts, and email addresses being blocked from re-registration. Users cannot verify erasure because Article 15 responses do not confirm the deletion state.
Article 12: transparent information
Vinted's terms permit unilateral suspension "at any time and for any reason". This is not compatible with the transparency obligations at Article 12, nor with the fairness principle at Article 5(1)(a).
How to file an ICO complaint
- Complain to Vinted first in writing, using the word "complaint" and a clear statement that you are exercising your rights under UK GDPR Articles 15, 17, 22 as applicable. Give them 30 days to respond substantively. Keep every reply.
- If the response is unsatisfactory, file with the ICO at ico.org.uk/make-a-complaint. Select the "data protection complaint" option.
- Include: the SAR you sent, Vinted's response, screenshots showing the automated nature of the ban, and screenshots of any appeal responses returned within a timeframe inconsistent with human review.
- The ICO will assign a case reference and, for systemic issues, may coordinate with the Lithuanian VDAI.
How to file a Lithuanian VDAI complaint
The VDAI is the lead supervisory authority. Filing with them is appropriate when your complaint concerns systemic patterns (mass bans, Article 22 failures, group-wide policy problems) rather than a purely individual data query.
- Email ada@ada.lt or use the online form at vdai.lrv.lt/en/services.
- State that you are a UK data subject affected by Vinted UAB processing, and that you are asking the VDAI to open (or reopen) an investigation into Article 22, 15 and 17 compliance following their July 2024 ruling.
- Reference the 2024 case (fine of €2,385,276) and note that the same failings you experienced persist in 2026.
- Provide sadvintedfaces.com as an evidence base showing the pattern at scale.
See the take-action page for a ready-to-send template.