OTT applications and social networks that use hidden features to eavesdrop, record calls, read messages or automatically retrieve data on the device without consent can be fined up to 150 million VND.
The regulations are stated in Article 65 of Decree 330/2026/ND-CP on sanctioning administrative violations in the field of cybersecurity and personal data protection, effective from August 19.
According to point b, clause 2, Article 65, OTT applications and social networks that use non-public technology features to eavesdrop, record calls, read text messages or automatically extract contacts and media files on the device without the consent of the personal data subject belong to the group of acts subject to a fine of 70-150 million VND.
This fine applies to organizations. Individuals who commit the same act are subject to half the penalty.
Thus, just because a user installs an OTT application or uses a social network does not mean the platform can silently use features without their knowledge to access calls, messages, contacts or files on the device.
For example, a messaging app that uses an unlisted feature to automatically read message content without the user's consent may be subject to sanctions.
Similarly, using hidden features to eavesdrop, record calls or automatically retrieve contacts, images, videos and media files on the device can also be handled if it falls into the case specified in Article 65.
In addition to fines, organizations that violate Clause 2, Article 65 may also be suspended from providing services in Vietnam for 3 to 6 months. Personal data, identification documents, contacts, and files that are illegally collected or extracted in prescribed cases may also be forcibly destroyed or deleted to the point of being unable to be restored.
The platform must clearly state what data it is collecting
Article 65 also stipulates responsibilities for organizations providing social networking services, online media and digital content platforms.
Organizations that do not clearly notify the content of personal data collected when users install and use social networks and online media services may be fined 50-70 million VND.
The same penalty applies to some behaviors such as not allowing users to choose to refuse the collection and sharing of cookies; does not provide a “do not track” option; does not publicly disclose a transparent privacy policy or does not have a mechanism for users to access, edit, or delete personal data according to regulations.
These regulations require platforms to be more transparent about the data they are collecting, while also giving users options to control the tracking, sharing and management of their data.
How to detect if an application is 'eavesdropping'?
For normal users, detecting an application that silently reads messages, records calls or retrieves contacts is not easy, because Article 65 mainly targets the use of "non-public technological features" - that is, functions that are not clearly shown to users.
Decree 330 also does not require users to find or prove that the application is "eavesdropping". When there are signs of violation, competent authorities can verify using electronic evidence, including data from electronic devices, information systems, accounts, images, sounds and other related data.
In other words, whether an application secretly accesses or collects data can be determined from the electronic traces that such activity leaves behind, instead of relying solely on whether the user sees or recognizes it.
The authority to sanction under Decree 330 is assigned to many agencies, including the Police force, the Chairman of the People's Committee and the Inspectorate within the scope of their functions and tasks. The police force alone has units specialized in cybersecurity from the provincial level to the Ministry of Public Security.
Therefore, users do not need to "catch" the application eavesdropping to be able to complain. Whether or not there is a violation must be examined, verified and concluded by the competent authority on the basis of evidence.
Decree 330 includes 4 chapters, 82 articles, and regulations on penalties in the field of cybersecurity and personal data protection. Sanctions related to personal data range from obtaining consent, collecting, processing, storing to disclosing, tracking location and using data on digital platforms.
In particular, organizations that consider a user's silence as consent to data processing may be fined up to 70 million VND; Individuals who disclose other people's data without consent, unless otherwise prescribed by law, may be fined a maximum of 25 million VND; Using location tracking technology contrary to regulations can be fined up to 150 million VND.
