Updated: WeChat’s privacy policy update draws attention to information shared with the government

To some extent, WeChat users were already aware of the possibility that the Chinese government was able to read their private information and messages, but it is still striking when WeChat prompted us to reexamine the privacy policy as the Tencent-owned messaging app detailed in its English policy all the user information it collects as well as its readiness to share this data with the government.

WeChat’s latest update greeted users with a new terms of use and privacy policy, which users must agree to if they want to use the app. WeChat acknowledges that it collects a wide range of personal information such as name, phone number, email address, credit card info, ID as well as the data you made available to the platform like location, chat logs data, and other shared information.

What caught so many people’s eye is the amount of information they share with the government to comply with “applicable laws or regulations.” According to the English policy, WeChat can disclose users’ personal information:

• in order to comply with applicable laws or regulations;
• in order to comply with a court order, subpoena or other legal processes;
• in response to a request by a government authority, law enforcement agency or similar body (whether situated in your jurisdiction or elsewhere);
• where we believe it is reasonably necessary to comply with applicable laws or regulations;

Interestingly, there seems to be an obvious difference in the company’s attitude when compared with the current update for Weixin (the mainland China version of the app) and a previous version for WeChat  (the global version of the app) users updated in 2015.

Different from the full compliance in providing data for “applicable law and regulations,” there’s little mention of sharing data with government bodies. Instead of blocking WeChat users from using the app, Weixin’s new privacy policy update says (our translation): “Unless it’s required by relevant laws, your objection in providing this information will block the feature concerned, but will not influence the usage of other features.”

The new Chinese privacy policy has evoked a series of outcry from Chinese users who rushed to WeChat on various app stores with furious comments.

“It’s already hardly bearable to collect our personal information. Now WeChat is going too far, even asking for smartphone contact list before logging into the app. Who do you think you are to ask everything about your users, the state secrecy administration?” commented a user under the pseudo name of “M梅梅”.

“User privacy and data protection are not just regulatory obligation but also a key part of the user experience. Weixin (the original Chinese version) has recently updated its privacy policy to reflect the enhancement of user privacy and data protection laws in China,” a Tencent spokesperson told TechNode. “Unfortunately, this fundamentally pro-privacy update was misinterpreted as an admission that we send all user data to the Chinese government. This is not and has never been the case.”

“In case of criminal investigations, we will provide certain information to law enforcement agencies when legally compelled to do so, which is in line with international practices,” they added, emphasizing that information on their servers are encrypted.

“More generally, we would like to emphasize the following points: 1. Protection of user data is a core value of the Weixin/ WeChat team and the updated privacy policy was part of an effort to improve upon this core value. 2. The updated privacy policy applies to Weixin users who have registered in China. 3. Reflecting different regulatory requirements, such as GJDPR, and a different privacy policy applies to users of WeChat (basically non-China users). This policy is reviewed and satisfied by TRUSTe on an ongoing basis,” they said.

Update 21 September 2017, 3 pm: The original article implied that the sharing of personal information with governmental bodies was new. This implication was incorrect; in fact, this part of the privacy policy was included in the 2015 WeChat (global version) Privacy Policy update. We have changed this and provided more detail on the new Chinese policy. We will update again once we get Tencent’s reponse.

Update 29 September 2017, 10am: Included Tencent’s response.