Is Zalo's sudden update to its terms and conditions illegal?

(NLĐO) - Zalo's updated terms and conditions are sparking a wave of reactions, even calls for a boycott, due to the appearance of content that is detrimental to privacy rights.

In recent days, Zalo has become the center of controversy after unexpectedly requiring users to accept new terms of service if they want to continue using the platform. This move has left many users confused, and even reacted strongly, given that Zalo has become a familiar communication, work, and transaction tool for tens of millions of Vietnamese people.

Reportedly, the updated terms and conditions are sparking debate on social media, with many expressing concerns about privacy and the collection and use of personal data. Some users feel they are being put in a "must agree or not continue using" situation, especially since Zalo currently plays a crucial role as a digital communication infrastructure in many agencies, businesses, and small-scale enterprises.

Zalo is a free messaging and calling application developed by VNG , launched in August 2012. By the end of 2025, the platform had nearly 80 million monthly active users, with approximately 2 billion messages sent daily. Its large scale means that any policy changes to Zalo have a wide-ranging impact and are likely to generate social backlash.

Speaking with us, Mr. Vo Do Thang, Director of Athena Cybersecurity Center, stated that Zalo's latest update to its terms of service is inappropriate. According to him, large social media platforms like Facebook or Google usually notify users well in advance, perhaps 30 days, of any changes related to privacy or personal data, allowing users time to consider and prepare a plan if they disagree.

Meanwhile, Zalo's sudden implementation of the new terms left users with almost no choice but to accept them or face service disruption. "This is disrespectful to users, especially for a platform with such a large position and deep connection to social life as Zalo," Mr. Thang commented.

The expert also expressed concerns about the responsibility of businesses in collecting, processing, and protecting personal data. In its "disclaimer of liability," Zalo states that if an incident occurs due to hackers or reasons beyond its control, the business may be exempt from liability. According to Mr. Thang, this regulation is unreasonable, because Zalo not only stores but also exploits data to serve its business ecosystem.

“If businesses use personal data to generate profits, then when risks occur, they cannot completely deny responsibility simply because of a cyberattack. What users need is transparency and a clear commitment to compensation when data is compromised,” Mr. Thang emphasized. He also suggested that platforms should publicly disclose the purpose of data use, storage duration, and data deletion process upon user request, similar to how many international platforms are doing.

Conversely, cybersecurity expert Ngo Minh Hieu (Hieu PC) argues that the frequent updating of terms of service by digital platforms is common and not unique to Zalo. According to him, Facebook, TikTok, Telegram, and Google all continuously adjust their policies to comply with new laws, add features, and update regulations regarding user privacy and data.

"No service is absolutely secure. Every application needs to use data to a certain extent to maintain functionality, personalize the experience, serve algorithms, and comply with the law. Users have the right to carefully read the terms and conditions and decide whether or not to use the service, rather than feeling confused or believing they are being completely forced," Mr. Hieu said.

According to Mr. Ngo Minh Hieu, many international platforms also apply similar measures. For example, Gmail may delete accounts after a long period of inactivity; Facebook, Instagram, and TikTok all require users to accept new terms if they want to continue using the service. However, the difference lies in the communication methods and the transition period for users.

Opinion poll

Zalo requires users to accept new terms of service to continue messaging, otherwise their service will be temporarily suspended. What are your thoughts on this?

You can choose one option. Your vote will be made public.

I agree because I need to use Zalo for work and daily communication.

Agreed, but concerned about privacy and the use of personal data.

I disagree; Zalo needs a clearer and more transparent explanation.

I disagree because Zalo is "coercing" users and putting them in a difficult position.

Vote | View results

From January 1, 2026, the Law on Personal Data Protection officially comes into effect, granting citizens more rights over their data. Accordingly, users have the right to request organizations and businesses to delete personal data when they no longer consent to its use. At the same time, social media platforms are prohibited from requesting images or videos containing personal identification documents as authentication, in order to limit the misuse of sensitive data.

This means that even if users accept the terms of service, businesses are not allowed to collect and process personal data beyond what is permitted by law. Compliance with the new law will be a crucial test for major digital platforms in Vietnam, including Zalo.

Source: https://nld.com.vn/zalo-dot-ngot-cap-nhat-dieu-khoan-moi-co-trai-luat-19625122821083053.htm