Vietnam fines TikTok, Zalo operators over data consent practices

[HO CHI MINH CITY] Vietnam’s competition watchdog has slapped Singapore-based TikTok and domestic tech firm VNG with fines totalling 1.69 billion dong (S$82,600) for breaching consumer protection rules in the collection and use of user data.

TikTok was fined 880 million dong; VNG, the operator of messaging app Zalo, received a penalty of 810 million dong.

The move follows a backlash over Zalo’s December 2025 update to its service terms, which forced its users – totalling about 78 million in Vietnam – to accept all provisions on data collection, storage and sharing, or risk account deletion after 45 days.

The update did not allow users to selectively opt out of specific clauses, prompting complaints and driving many to seek alternative messaging apps.

According to Vietnam’s competition watchdog, violations by the two apps included the lack of mechanisms for consumers to choose whether their data could be used for advertising or other commercial purposes, as well as terms that breached general transaction conditions.

In Zalo’s case, it had failed to provide users with a method to choose the scope of information they consent to provide.

Following the ruling, the authority noted that VNG had reviewed and updated its policies, and has already addressed several issues while working to resolve the remaining ones.

The Business Times has reached out to TikTok – which has about 70 million monthly active users in Vietnam – for comment.

The fines come as Vietnam’s new Personal Data Protection Law and its guiding decree, which took effect at the start of 2026, begin to shape the country’s digital landscape.

SEE ALSO

Vietnam’s dominant messaging app faces regulatory scrutiny over data policy update

Under the rules, companies must obtain explicit user consent to collect personal data, including basic details such as phone numbers, names, gender and family relationships, as well as “sensitive” data, including identity documents, GPS-based location, and user behaviour across social media and other digital platforms.

“This is where the business model (of digital platforms and adtech) is at risk,” said Phat Tran, managing lawyer at Ho Chi Minh City-based law firm Henrison Law.

He noted that the industry previously thrived on implicit consent and third-party data sharing. “With Vietnam’s strict ‘opt-in’ requirements and the ban on unauthorised data trading, companies that monetise user profiling must fundamentally re-engineer how they acquire and retain value.”

Tran suggested that app operators offer users multiple consent options instead of “all-or-nothing” ultimatums, separating core service processing from optional uses such as marketing or third-party sharing.

He also recommended a plain-language “key highlights” summary alongside full legal terms, clearly showing what data is collected, who it is shared with and how users can control or stop processing, such as withdrawing consent, adjusting settings or deleting their account.