Zalo updates terms to expand personal data collection, sparks backlash in Vietnam

Under the new terms, Zalo, operated by VNG Corporation, one of Vietnam's leading tech firms, seeks to expand the collection of user data, including phone numbers, full names, gender, and family relationships, as well as sensitive information such as citizen ID numbers, location, usage behavior, and interaction content.

Users must accept all terms or face account deletion after 45 days, with no option for partial consent.

The move has sparked widespread criticism online.

Duc Vu from Ho Chi Minh City said Zalo is seeking access to personal information such as ID cards, gender, age, and other private details while forcing users to either agree or stop using the platform.

"It is excessive," he commented.

Another user, Manh Trinh, added that the company "reserves the right to collect data and moderate content without explanation, while disclaiming responsibility if information is leaked, putting users in a difficult position."

The update also allows Zalo to share account data with affiliated companies within the VNG Corporation.

"Even if users only use Zalo, VNG can utilize their personal data across subsidiaries, whether or not the user engages with those companies," a privacy expert noted.

Some users have announced plans to delete their accounts in protest.

Experts warn Zalo's 'accept all' approach may be coercive and conflict with the voluntary consent principle under the new law.

Nguyen Phu Dung, CEO of Pila Group, a leader in digital identity solutions, said users' concerns over Zalo's updated terms are understandable.

He added that the core issue lies not in data collection itself but in how it is done, its intended use, and user control. 

"Offering only an 'accept all' option makes consent coercive and easily erodes trust," he stated.

Tran Viet Quan, founder and chairman of Skillify, a digital skills education platform, noted that Zalo is unlikely to violate domestic regulations, adding that accepting the updated terms remains a user choice.

Many users, despite concerns, still agreed, citing reliance on Zalo for personal, professional, or business contacts.

Nguoi Lao Dong (Laborer) newspaper cited Vo Do Thang, director of Athena Cybersecurity Center, as saying that Zalo's sudden update was inappropriate.

Such an abrupt approach, he said, reflects a lack of respect for users, especially for a platform as deeply embedded in social life as Zalo.

He added that platforms such as Facebook and Google typically provide at least 30 days' notice for privacy-related changes, giving users time to consider alternatives.

Meanwhile, Zalo maintains that updating terms is a standard practice globally to ensure legal compliance and keep users informed, encouraging anyone with questions to contact its official support hotline.

Yet skepticism remains over its collection of extensive personal data, including family relationships and government-issued ID numbers, which critics say exceeds Government Decree 147, under which ID numbers are required only if a phone number is unavailable.

Zalo has not publicly addressed these concerns but said it is ready to assist users through official channels.

Launched in 2012, Zalo is Vietnam's leading messaging and calling app, with 79.2 million monthly users in Q3 2025 and 2.1 billion messages sent daily.

By the end of 2024, it operated 17,273 official accounts for government agencies and public utilities, reaching over 40 million followers nationwide and providing access to services in all 63 provinces then, surpassing international competitors like Messenger and Facebook.

From January 1, 2026, the Law on Personal Data Protection will give citizens greater control over their personal data, Nguoi Lao Dong reported.

Users can request that organizations delete information if consent is withdrawn, and social networks are prohibited from requiring images or videos of identification documents for authentication as a measure to prevent the misuse of sensitive data,

Even if users accept service terms, platforms are not allowed to collect or process personal data beyond what the law permits.