Vietnam's competition watchdog asks Zalo to revise user terms, allow opt-out

Vietnam’s competition watchdog has asked tech unicorn VNG to revise how it implements the terms of service on its messaging app Zalo, saying users must not be forced to accept data collection and usage conditions in order to continue using the platform.

In a statement on Wednesday, the Vietnam Competition Commission (VCC), under the Ministry of Industry and Trade, said it had summoned VNG (UPCoM: VNZ) to work on issues related to Zalo’s collection and use of user data and its provision of services.

The commission said it had received a request from VNG to postpone a scheduled working session, with the company citing the need for more time to prepare relevant information and documents. VNG also told the regulator it is coordinating with other authorities on the matter.

To mitigate risks and protect consumer rights, the VCC said it has required VNG to review and adjust the implementation of Zalo’s service agreement. Users must not be placed in a position where consent to the collection, storage and use of personal data is a condition for accessing services, the commission said, adding that users must be given a genuine option to agree or decline.

The watchdog also asked VNG to review all existing and planned user contracts and transaction terms to ensure compliance with consumer protection regulations before they are implemented.

In addition, the commission urged the company to safeguard user data and refrain from transferring personal information to third parties for users who have accepted the updated Zalo service agreement.

The VCC said it will continue working with VNG once the company submits the requested information, with the aim of protecting users’ legitimate rights and interests in the digital environment.

Zalo, Vietnam’s most widely used messaging platform with more than 80 million users, recently notified account users that they must accept updated terms of service to continue using the app. The new terms allow Zalo to collect and share personal data, including basic information such as phone numbers, names, and identification details, as well as sensitive personal data.

Users who do not agree will lose access to the service, and their accounts will be automatically deleted after 45 days if they do not change their decision. The update has triggered public backlash, with users arguing the terms infringe on data privacy rights.