Losing the voluntary nature of the data subject
Zalo has just released a series of controversial personal data collection terms. Notably, if users do not agree with the terms of the agreement offered by Zalo, they will not be able to continue using the service.
In addition, an issue that public opinion is concerned about is the timing of Zalo's service terms update, which takes place just a few days before the Law on Personal Data Protection takes effect from January 1, 2026.
On December 29, exchanging with a reporter from Lao Dong Newspaper about this issue, Lawyer Tran Xuan Tien - Head of Dong Doi Law Office (Hanoi Bar Association) said that the Law on Personal Data Protection, effective from January 1, 2026, will tighten, requiring all data collection activities to have transparent consent and be within a strict legal framework.
According to the lawyer's point of view, Zalo's motivation in updating the clause right before the law takes effect is: "Exploying and maintaining the final legal basis for the use of user data".
This is to ensure that they can still access the "fuel" source of personal data, which is a key factor in maintaining a business model based on personalized advertising and increased services.
By taking advantage of the "time window" to seek new, broader consent from users before strict regulations are officially applied. This is to create a legal basis for their data exploitation activities after the law takes effect," lawyer Tran Xuan Tien stated his opinion.
The lawyer also said that Zalo's update of the personal data collection clause right before the Law on Personal Data Protection took effect is not itself prohibited by law.
However, the time of issuing the clause is not a basis for exemption from the obligation to comply with the law. Since the law takes effect, all personal data processing activities taking place must be in accordance with current legal regulations.
According to the Law on Personal Data Protection, the consent of the data subject is only legal when it is voluntary, clear and not forced. Attaching the consequence of locking or restricting accounts to users who do not agree to allow data collection shows signs of losing the voluntary nature of consent, because users are placed in a disadvantageous situation to be forced to accept" - Lawyer Tran Xuan Tien said.
Still consider violations if data subject rights are not guaranteed
In the story of Zalo collecting user personal data, the request to take photos of personal papers (citizen ID card, ID card or passport) also caused much controversy.
According to Lawyer Tran Xuan Tien, the law stipulates the principle of minimizing data, only necessary personal data, suitable for the purpose of processing, can be collected.
For messaging and communication services, the requirement to collect strong identification data such as citizen identification cards needs to be proven to be really necessary.
The law does not judge "intentions to evade the law" but considers the nature and legal consequences of data processing behavior. Therefore, although the Zalo clause was issued before the Law on Protection of Personal Data took effect, if it continues to be applied after this time and does not guarantee the rights of the data subject, it may still be considered a violation of the law" - the lawyer said.
Regarding this issue, according to cybersecurity expert Ngo Minh Hieu, Zalo is an "infrastructure" containing a lot of important information. The main concern is transparency and the question "Who controls the use of your sensitive data?". According to experts, no application is absolutely safe and people should avoid sending sensitive information such as financial contracts, business strategies or deep private conversations...
According to self-published statistics, by September 2025, Zalo has 79 million monthly regular users and about 2 billion messages sent every day. According to records, after the move to update service terms, Zalo has been heavily rated 1 star on online application marketplaces and has been called for boycott by a part of users.
