In the final days of 2025, millions of Vietnamese Zalo users received an unexpected notice: accept new terms of service within 45 days or lose access forever.

Zalo’s demand  -  to approve expanded data collection and sharing policies  -  has been called an ultimatum. For a platform with over 78 million active users, embedded in everything from school-parent communication to government messaging, this is no small matter. The options are stark: “Agree or disappear.”

A false sense of choice?

Under Vietnam’s Personal Data Protection Law, consent must be informed and voluntary. But Zalo’s all-or-nothing approach leaves no room for selective agreement  -  a practice critics call "bundled consent."

Essential services like messaging are tied to optional services like targeted advertising, third-party data sharing, and AI training  -  all wrapped in one click.

Why would Zalo risk backlash? The answer lies in the value of user data. In today’s digital economy, data is gold, and Zalo is transforming from a chat app into a platform for AI and financial services.

Global pushback against forced data deals

Zalo’s move mirrors controversial practices elsewhere. In the European Union, Meta’s “Pay or Consent” model  -  requiring users to either pay to avoid tracking or accept it  -  was struck down in April 2024 by the European Data Protection Board (EDPB).

The EDPB ruled that platforms with significant power must offer a genuine alternative: users should not be forced into consenting just to access essential services.

Compared to Meta, Zalo’s policy is even more rigid  -  there’s no pay-to-protect option, only acceptance or exclusion. This, critics argue, is a blatant violation of digital self-determination.

In India, a similar 2021 move by WhatsApp to compel data sharing with Facebook triggered an official investigation. The result? Meta was fined $25.3 million, WhatsApp was barred from data sharing for ads for five years, and had to implement an opt-out for non-core services.

Even China, home to digital giants like WeChat, enforces strict rules. The Personal Information Protection Law (PIPL) requires separate consent for different data uses  -  such as accessing contacts or transferring data  -  ensuring transparency and user control.

Vietnam’s legal arsenal is ready  -  but must be enforced

Vietnam’s existing legal framework already provides tools to address this situation.

Under the Personal Data Protection Law, users can withdraw consent at any time (Article 10). However, Zalo’s threat to delete accounts if consent is withdrawn creates a technical and psychological barrier, effectively nullifying this right. This may violate the law’s ban on obstructing user rights.

More importantly, under the 2018 Law on Competition, with 85% market share, Zalo clearly holds a dominant position. Article 27 prohibits such firms from imposing unfair terms or restricting market participation.

Forcing users to accept extensive data sharing to access basic services could be viewed as an abuse of dominance  -  similar to how Germany’s antitrust authority ruled against Facebook’s data practices as anti-competitive, even though they were framed as privacy issues.

When the cost of leaving is too high

Why do users still click "agree"? Because switching costs are enormous.

Small businesses rely on Zalo to run daily operations. Government agencies use it to send official notices. Opting out means severing ties with vital parts of the social and economic infrastructure.

In this context, consent is coercive, not voluntary. The principle that “personal data is inviolable” is now under threat from the power of digital platforms. Zalo’s 45-day ultimatum is not just a business decision  -  it is a crucial test of the strength and credibility of Vietnam’s data laws.

What must be done?

Regulators should urgently demand that Zalo justify the 45-day deadline and explain how its policy aligns with user rights under the law.

They must investigate whether Zalo is abusing its market dominance by treating personal data as a commodity forced upon users under duress.

Long term, Vietnam should consider adopting a model similar to the EU and China, requiring separate consent for each data purpose. Users must have the right to say yes to messaging, but no to AI training or data-sharing. Basic services should not be denied for refusing enhanced tracking.

Zalo may also need to be classified as a "critical digital platform" or "essential digital service"  -  which would impose higher responsibilities in neutrality, transparency, and community service.

As platforms grow more powerful, it is essential they remain accountable to the core values of human dignity and digital fairness.

Nguyen Phuoc Thang (Hoa Binh University)