Businesses that use personal data to serve the goal of promoting products and services may face many obstacles in the near future. They can be sued for ad spam and it is difficult to avoid legal litigation.
Ad spam – from marketing to the risk of breaking the law
Advertising spam is often understood by many Vietnamese businesses as sending advertising messages with high frequency, the wrong audience or at the wrong time. According to the provisions of Decree 91/2020/ND-CP on combating spam messages, spam calls and spam emails, the nature of spam behavior does not lie in the number or frequency, but in the fact that the recipient does not agree or has refused but continues to be sent advertising[1] messages.
Going further, Decree 13/2023/ND-CP on personal data protection has set a strict legal framework, in which sending advertising messages without the valid consent of the data subject is considered an act of unlawful processing of personal data[2]. This means that if the enterprise does not have a clear legal basis to prove that "permission has been requested, consent has been received", the entire chain of data processing behaviors, from collection, storage, use to sharing, can be considered a violation of the law. Notably, the law does not distinguish between the size of a large enterprise or an SME company or the field of operation.
The responsibility belongs to the enterprise
One of the core principles of the law on personal data protection is the obligation to prove the enterprise - the party that controls and processes the data. When receiving a complaint for ad spam, the regulator will ask the business to provide evidence that the recipient has given clear, specific, and verifiable consent to the receipt of advertising messages.
According to Decree 13/2023/ND-CP, valid consent must meet the following criteria: (i) It is clearly and separately expressed for each purpose of data processing; (ii) There is an easy and free rejection mechanism; and (iii) the data is processed to the extent notified. So in the event that a user has left contact information, registered an account or made a purchase, the business must not be deduced as a customer and also agree to receive ads later. Agreeing to use the service does not mean agreeing to receive marketing messages.
The legal consequences of this principle are enormous. Proof of consent, or "consent record", is now not just technical data, but legal evidence equivalent to an electronic contract. If the business fails to store this evidence, then in an inspection or dispute, it will be automatically considered to have processed the data unauthorized. Practice shows that many businesses when asked to provide evidence of "consent" have not been able to produce anything other than a list of phone numbers and transaction history, data that does not meet legal requirements.
The situation is likely to become more serious from January 1, 2026, when the Personal Data Protection Law 2025 officially comes into force. This law sets a new sanctions framework, with a maximum fine of up to 3 billion VND for organizations, and if it is an administrative violation of buying and selling personal data, the fine can be up to 10 times the illegal revenue. In addition, the regulator also has the right to request businesses to delete data, suspend or ban data processing for a certain period of time, causing advertising activities to be "frozen" immediately.
Necessary legal response – from technical handling to process restructuring
When receiving a complaint about ad spam, a common reaction is to remove the phone number or e-mail address (of the complainant) from the submission list, apologize to the customer, or stop the campaign. However, it was only a media response, not enough to meet the legal requirements.
The correct legal response must begin with reviewing the entire data source, determining the legal basis for the processing, and restructuring the processing of personal data related to advertising. Businesses need to clearly identify where the data used for advertising is collected from, from former customers, from partners, or acquired from third parties. If it is acquisition data, it is necessary to check whether the seller has the right to share the data. A data supply contract cannot be a legal shield if the seller does not have legal ownership of the data. Vietnamese law clearly stipulates that the Personal Data Controller is responsible to the data subject for damages caused by the processing of personal data[3]. Therefore, the fact that businesses do not directly collect users' personal data but are using this data for advertising purposes will still not be exempt from liability.
Next, the business needs to pause advertising using the complained data source, and conduct an internal audit to determine which system sent the message, who approved the campaign, and which system the data file is in. This is not only a technical measure, but also evidence of goodwill and cooperation, which can be considered mitigated in the process of handling administrative violations.
Finally, businesses need to have a clear feedback and remediation mechanism such as sending a written notice to the complainant of handling measures, recording the request for refusal, and deleting data if requested. A legal, transparent, and timely response not only helps ease tensions, but also shows that the business understands and respects its legal obligations. Unfortunately, many businesses still choose to remain silent or avoid complaints, leading to the regulator being able to raise the fine. Meanwhile, if the enterprise actively cooperates and overcomes the consequences, the reduction of the penalty may be considered by the competent authority.
The legal department is a companion to the marketing department
One of the important reasons that can lead to violations of the law in advertising activities of businesses is the separation between the marketing department and the legal department. While both are dealing with the same asset as customer personal data, they lack the coordination needed to ensure compliance with the law. Advertising is not prohibited by law, but advertising requirements must be based on voluntary, explicit consent and purpose limitation. Businesses can be aggressive in marketing, but they must be transparent, namely that users need to know what data they are providing and to whom, and have the right to withdraw their consent at any time. Change is difficult, but it is an inevitable trend.
In Europe, after strict penalties under the GDPR, many businesses have switched to a "privacy-first marketing" model, collecting less data, retaining it shorter, and only advertising based on real consent. They recognize that data trust is a long-term competitive advantage, something that fines can't buy.
In short, complaints about ad spam, if viewed from a compliance perspective, are not a risk to be avoided, but an early warning signal that the data management system of the enterprise is vulnerable. If not handled in time, the consequences will not stop at the level of administrative fines, but may lead to the suspension of data processing activities, directly affecting the sustainable business activities of enterprises.
Lawyer Nguyen Nhat Duong
HM&P Law Firm
Read more: Cách doanh nghiệp xử lý khi bị khiếu nại vì SPAM quảng cáo
