Zalo’s 45-Day Deadline and the Identity Data Crisis in Việt Nam

“Agree to the terms or lose your account.” 

This is the ultimatum effectively issued by Zalo, the dominant messaging application in Việt Nam. [1] Recently, users opening the application have been met with an “Agree to all” prompt covering 16 dense, lengthy clauses that few have the time or patience to scrutinize.

Zalo essentially requests permission to gather, retain, and use personal data throughout a user's tenure on the platform. [2] This collection extends far beyond phone numbers and message metadata, including sensitive personal information linked to accounts that Zalo may use across its affiliated entities for various purposes. [3]

While data collection is a standard industry practice, the implementation has sparked significant public backlash. By forcing a choice between total compliance and account deletion, Zalo has placed its users in a coercive position, triggering widespread online outrage.

Critics argue that this approach constitutes the forced surrender of personal data. Conversely, some defenders ask why Zalo is being targeted when Western platforms like Facebook and Instagram engage in similar practices.

This comparison raises a crucial question: What distinguishes the data collection practices of Western platforms from those of domestic platforms in Vietnam?

Types of Data Collected

While Facebook and Instagram collect vast amounts of data, their focus is primarily on behavioral information—the digital traces left by users. [4] This includes clicks, content views, interactions, device types, and locations. Algorithms aggregate these fragments to infer preferences and serve targeted advertisements. 

These platforms generally disclose their data usage purposes and provide tools for users to manage their personal information. Essentially, their data collection seeks to answer one question: “What do you do on the platform?”

Zalo, however, goes significantly further. Its updated policy extends into data tied to legal identity, including identification documents, family relationships, and personal images.

This shifts the focus from “What do you like?” to “Who are you?” Integrating such sensitive information into default processing mechanisms significantly increases the level of risk.

This is not to suggest that behavioral data is harmless. By monitoring habits, systems can trap users in “algorithmic bubbles,” shaping behavior and controlling content consumption. Nevertheless, these risks are largely digital.

Identity-linked data is different; if information tied to legal records and family relationships is compromised, the consequences—such as identity theft, fraud, and threats to personal safety—extend into the physical world. This is why many users now view accepting Zalo's terms as a crucial decision.

Is Refusal an Option?

In the digital age, data collection by applications is almost a certainty. However, the acceptability of this practice hinges on a single condition: the ability of the user to refuse. 

The public outcry against Zalo stems from both the content of its terms and its all-or-nothing presentation. Users are being issued a condition: accept the terms or lose access to the application. Media reports even suggest that accounts will be deleted after 45 days of non-compliance.

When a choice is framed as a requirement for continued service, consent becomes a form of coercion. Zalo has grown to be an essential part of Vietnamese society, with almost 80 million monthly users in a country of 101 million. [5] It is unrealistic to expect citizens to abandon such a deeply integrated platform and its associated conveniences over a privacy policy.

The European concept of “valid consent” provides a relevant comparison. [6] Under these standards, users must be able to refuse or withdraw consent without facing negative consequences. If refusal leads to a total loss of service, the consent is not considered freely given.

While the legal framework in Việt Nam differs from that of Europe, the principle that genuine consent requires a real choice helps explain the current intensity of the backlash against Zalo.

Can Consent Be Withdrawn?

Users who reflexively clicked “agree” may later experience themselves wanting to withdraw that consent upon realizing the associated risks. While the terms of Zalo acknowledge the right to withdraw consent or restrict data processing, this right is far from absolute. Zalo reserves the right to refuse such requests, and any withdrawal has no impact on data that has already been collected. [7]

Such an arrangement creates a significant gap between domestic practices and international standards. Global data protection frameworks emphasize that withdrawing consent should be as easy as providing it.

Many major platforms offer tools for users to manage or delete their data—despite the complexity of such tools—while Zalo makes the withdrawal of consent conditional. Ultimately, a user's ability to reclaim their privacy on Zalo depends entirely on the platform's approval.

Where Does the Data Go?

Zalo’s updated terms grant the platform permission to share user data throughout the VNG “ecosystem,” a network that includes 33 subsidiaries and affiliates worldwide. [9]

A significant issue for transparency is that VNG does not provide an official, exhaustive list of these entities. Consequently, users face extreme difficulty in determining exactly where their information is being directed.

Critical questions remain: to which services is the data transferred? What specific purposes and durations do these transfers serve? What oversight governs these transfers? 

While Western tech giants like Meta also refrain from publishing complete lists of every minor affiliate, they typically offer tools that allow users to manage and control how their data is shared across the platform’s various services. [10]

The lack of similar transparency or control mechanisms within the VNG ecosystem leaves the ultimate destination of user data largely obscured.

The Việt Nam Context

Arguments that “all applications collect data” overlook a critical reality: in Việt Nam, Zalo is far more than a source of entertainment. It has evolved into the country’s default communication infrastructure, used for professional correspondence, educational updates, family ties, and civic coordination.

Most users do not use Zalo by choice, but because the social and practical cost of opting out is too high.

When a platform of such systemic importance issues a "take it or leave it" ultimatum, the consequences move beyond the individual. The primary concern is not the fact of data collection itself—which is nearly unavoidable today—but the specific targeting of identity-linked data.

By making access to essential social infrastructure conditional on the surrender of sensitive personal information, Zalo has created a situation where "consent" is no longer a meaningful choice.

KHANGTHUHAI wrote this article in Vietnamese and published it in Luật Khoa Magazine on Dec. 29, 2025. Đàm Vĩnh Hằng translated it into English for The Vietnamese Magazine.