As Lao Dong Newspaper has reported, recently, "Zalo suddenly collected user face and voice data" to identify users, replacing the previous method of taking photos of personal papers.
The move is said to be aimed at adjusting when the Law on Personal Data Protection takes effect from January 1, 2026, in Article 29 on Personal Data Protection for social networking platforms and online media services, the Law stipulates "No request to provide images or videos containing full or part of personal papers as an account authentication factor".
However, Zalo's switch to identifying with face and voice authentication also raises many questions, even risks with more unpredictable consequences.
Talking to Lao Dong Newspaper reporters, Lawyer Tran Xuan Tien - Head of Dong Doi Law Office (Hanoi Bar Association) - emphasized that this is a more worrying issue because faces and voices are sensitive personal data at a high level.
According to the Law on Personal Data Protection, biometric data such as faces and voices used for identification belong to sensitive personal data groups, which are strictly protected by law. The level of privacy infringement of this type of data is even higher than images of personal papers, because it cannot be changed or "reissued" when leaked" - Lawyer Tran Xuan Tien analyzed.
At the same time, the lawyer also affirmed that changing the collection method does not change the legal nature. The platform still needs to prove: The purpose of collection is really necessary for the service; Data scope is minimum; Storage time, security measures, third parties accessing data are all public and transparent.
If these factors cannot be proven, whether it is a citizen identification card (CCCD) or biometrics, there is a risk of violating the law on personal data protection.
According to Lawyer Tran Xuan Tien, in this case, the risk for users is very high. Because facial and voice data can be abused for behaviors such as identity forgery, deepfake, and high-tech fraud.
When a leak occurs, the user's damage is long-term and difficult to overcome, while the responsibility for compensation and remediation of the business's consequences is still a big question. Zalo's shift to collecting biometric data cannot be seen as a solution to "legalize" user identification.
On the contrary, this is an issue that needs to be closely monitored by state management agencies and users have a full legal basis to question, object or request clarification about the necessity, legality and safety of this activity" - Lawyer Tran Xuan Tien stated his opinion.
Previously, in the last days of 2025, Zalo issued a series of controversial personal data collection terms. If users do not agree with the terms of the agreement issued by Zalo, they will not be able to continue using the service.
On December 29, the National Competition Commission (Ministry of Industry and Trade) sent an invitation to VNG Group Joint Stock Company, regarding the collection and use of user information on the Zalo platform.
By December 31, VNG Company proposed to postpone the working schedule with the Ministry of Industry and Trade on updating the Zalo usage agreement because the information content needs to be summarized and prepared.
