Targeted advertising and the problem of protecting personal data: A legal perspective

Targeted advertising campaigns have become the main tool of businesses in reaching consumers today. From searching for a car, buying a book, or simply stopping for a few seconds in front of a video on social media, the hidden data system then silently records, analyzes, and "personalizes" the next ad that appears on your screen. That's the power of data, but it's also the source of new legal risks, security risks, and personal privacy risks.

What is targeted advertising and where do the legal issues lie?

In essence, targeted advertising is more than just marketing. It is an intentional chain of personal data processing where a user's data from access, location, gender, age, interests, consumption habits, even personal relationships are collected, analyzed, and used to predict or shape their future behavior. The more accurate the user identification, the more effective the ad will be. But because of this, this process raises the legal question of how that data is collected, how is it processed, and whether the user actually consents to it?

If at the previous stage, the majority of Vietnamese enterprises considered data collection as a natural part of their business, since Decree 13/2023/ND-CP on personal data protection ("Decree 13") came into effect, all acts of data processing, including the collection,  archiving, analyzing and sharing all must have a valid legal basis. For personalized advertising, the only basis that can usually be invoked is the consent of the data subject. And this is the crux of the matter. According to Articles 11 and 12 of Decree 13, the consent of the data subject is only valid when it is expressed clearly, voluntarily, specifically and can be withdrawn. Meanwhile, the current reality shows that most online platforms, including Facebook, TikTok or e-commerce platforms in Vietnam, include the consent clause in the "Privacy Policy" or "Terms of Service" section that users are forced to accept to use the product. Consent in such circumstances is no longer voluntary, because if refused, the user cannot access the service. This leads to the core legal question of whether businesses have the right to use data collected from user behavior for personalized advertising purposes without separate consent? The answer, in accordance with the spirit of Decree 13, is no. It is not enough to include "consent for advertising purposes" with "consent to use the service", because the purpose of processing must be clearly distinguished and communicated. Businesses can only legalize the processing of data for advertising if there is a mechanism for obtaining and storing separate proof of consent, and providing the right to withdraw consent at any time.

Existing breach risks

More than just data collection, a more sophisticated issue lies in the type of data used for advertising. The majority of advertising data is behavioral data, what users search for, the pages they visit, the videos they watch, or the products they buy. However, many times such acts can disclose or through data analysis based on algorithms of information in the group of "sensitive personal data" as prescribed in Clause 4, Article 2 of Decree 13, such as health status, political opinions, etc  religion, sexual orientation, or financial status. At that time, the use of this data for commercial purposes not only violates the principle of consent, but can also be considered a serious infringement of the privacy of individuals.

In the past few years, many "giants" such as Facebook and Tiktok have also been involved in lawsuits related to personal data protection, even being fined with record fines. Specifically, in 2023, Meta Company[1] was fined EUR 1.2 billion by the Irish Data Protection Authority (IE DPA) for transferring European user data to the United States in violation of GDPR regulations[2]. That same year, the Irish Data Protection Commission (DPC) fined TikTok EUR 345 million for failing to guarantee the privacy of minors in behavioral advertising[3]. Or recently, in 2024, South Korea's Personal Information Protection Commission (PIPC) fined Meta $15.6 million for selling the sensitive data of nearly 1 million people. Specifically, Meta allegedly collected data such as religious and political views, marital status, and sexual orientation of about 980,000 local Facebook users, and then passed the information on to about 4,000 advertisers, who used the data to create customized ads based on users' personal interests,  without specifying where personal data is used in its data policy and without seeking user consent or implementing additional safeguards[4]. The above examples are a clear demonstration that data-driven commercial behavior, even if it is economically reasonable, can still violate the law without a legal basis to protect individual rights.

In Vietnam, although there have been no cases of similar magnitude, the legal risks associated with targeted advertising are clear and increasing. According to Decree 13, all businesses that process personal data must notify the data subject of the purpose, scope and third party receiving the data; at the same time, if the data is transferred abroad, the enterprise must make a dossier to assess the impact of data transfer abroad to submit to the Ministry of Public Security. In fact, many businesses are carrying out this activity without knowing that they have fallen into the regulatory area of regulations on cross-border data transfers.

Notably, from January 1, 2026, the Law on Personal Data Protection 2025 will officially take effect, creating a unified legal framework at the legal level. This law adds a reporting mechanism, the responsibilities of data controllers and data processors, and stronger sanctions for the processing of personal data, transferring data abroad without an impact assessment. The fines to be applied in the coming time can be mentioned as a fine of up to 10 times the revenue obtained from the violation for the act of buying and selling personal data, a fine of up to 5% of the revenue of the preceding year of that organization for organizations that violate regulations on cross-border personal data transfer, etc  a maximum fine of VND 03 billion for other violations in the field of personal data protection. Even violating individuals and organizations are at risk of being considered for criminal handling.

Balancing commercial interests and privacy

From a policy perspective, it is undeniable that personalized advertising brings real benefits to both businesses and consumers, it helps reduce advertising costs, increase conversion rates, and provide more relevant information to users. But that can't be a reason to trade off privacy. The core of the problem lies in how the business implements and demonstrates compliance.

A viable compliance model is to establish a clear "opt-in" mechanism for personalized advertising, completely separate from consent to use the service. Users can choose to "consent" or "disagree" to the use of behavioral data for advertising, and this choice must be recorded, stored, and can be changed at any time. At the same time, businesses need to perform a data processing impact assessment for every targeted advertising campaign.

In addition, special attention should be paid to the contractual relationship between data processors, platforms, advertisers, and data analysis partners. The contract must specify the scope, purpose, duration of processing, security measures, and the obligation to notify when there is a data breach. In fact, many Vietnamese businesses still participate in the advertising chain without a data processing contract, leading to the impossibility of clearly determining who is responsible if an information leak occurs.

In conclusion, targeted advertising is the most concrete manifestation of the data economy era, where personal information becomes a commercial asset. However, the commercial value cannot exceed the legal value of privacy. A business that uses user data for advertising without a mechanism for obtaining permission and managing explicit consent, does not control the flow of data across borders, or does not delineate responsibilities between parties, is, in essence, operating on the basis of legal risks.

Lawyer Nguyen Nhat Duong

HM&P Law Firm