PCPD Releases Report on “Comparison of Privacy Settings of Social Media” 

12 April 2022

As the public has become increasingly aware in recent years of the personal data privacy risks related to the use of social media, the Office of the Privacy Commissioner for Personal Data (PCPD) today released a report on “Comparison of Privacy Settings of Social Media” after a review of the top ten most commonly used social media platforms in Hong Kong, including Facebook, Facebook Messenger, Instagram, LINE, LinkedIn, Skype, Twitter, WeChat, WhatsApp and YouTube (in alphabetical order).

According to the review results, the performance of the ten social media in terms of their privacy functions, privacy policies and the usability of privacy dashboards are summarised as follows:

• All the social media reviewed have privacy policy in place.  They collect a wide variety of personal data, ranging from 12 to 19 types of personal data.
• All the social media reviewed would collect users’ location data (including both the precise and coarse locations).
• In terms of the default privacy settings, the age and telephone number of a user are not disclosed by Skype and YouTube, while the other social media reviewed disclose users’ personal data such as age, location, email address or telephone number by default.
• Twitter, WeChat and YouTube receive the highest scores for readability of their privacy policies, while the others that do not score full marks mainly lack infographics, tables or short videos in illustrating their privacy policies.
• Apart from WeChat, all other instant messaging applications reviewed including Facebook Messenger, LINE, Skype and WhatsApp deploy end-to-end encryption in the transmission of messages between users.
• Except for LINE, all other social media reviewed provide two-factor authentication.
• Most of the social media reviewed would retain users’ credit card data.
• All the privacy policies of the social media reviewed explicitly state that users’ personal data would be transferred to their affiliated companies.
• Twitter does not provide its privacy policy in Chinese text.  Users who do not read English would find it difficult to understand the social media’s policies relating to the handling of their personal data.
• Facebook, LINE, WeChat and YouTube all allow users to disseminate posts to specific individuals or groups, and modify the privacy settings of the contents after posting.

[...]