"Vietnam’s dominant messaging app faces regulatory scrutiny over data policy update", 31 December 2025

Vietnam’s National Competition Commission (NCC) has issued a stern directive to Zalo, the country’s leading messaging app operated by local tech giant VNG, demanding immediate changes to its rollout of updated service terms following a surge in user complaints.

In a formal notice …, the NCC instructed VNG to “review and adjust the implementation of Zalo’s service agreement in a way that does not place consumers in a position where they must consent to the collection, storage and use of their personal information as a condition for continuing to use the service.”

The committee stressed that consent mechanisms must be “voluntary, clear and substantive, not merely formal”, and called for measures to temporarily suspend third-party data transfers involving users who have already accepted the new terms.

The directive came after Zalo rolled out a revised service agreement with tens of millions of users just days before Vietnam’s Personal Data Protection Law takes effect ...

Under Zalo’s latest update, users must either accept all provisions governing data collection, storage and sharing, or face account deletion after 45 days. The app does not allow users to selectively opt out of individual clauses, effectively imposing an all-or-nothing choice.

Newly introduced provisions also limit corporate responsibility for data-related risks. They state that VNG offers no guarantees regarding service stability, information security or the accuracy of information users receive on the platform. Users are also required to indemnify VNG against losses arising from their use of – or inability to use – the service.

…......, Zalo notified users via its smartphone app that the updated terms of service do not alter the app’s functionality, but are intended to meet regulatory requirements.

The company said it collects certain user data to support service operations and account security, adding that citizen identification information is gathered only when account verification is required or for fraud prevention.

Zalo also said it does not store or use the content of private messages or calls for any purpose, and that user data is shared with third parties only with user consent and in line with legal requirements.

… The policy update has triggered a strong backlash among domestic users…

… In its latest statement, Zalo said its systems meet the ISO/IEC 27001:2022 international standard for information security.

The company added that it is seeking regulatory approval to roll out end-to-end encryption, which would further strengthen the security of private conversations on the platform…