- Money transfers provider hides user data opt-in in fine print
- 520 million users affected
- Alipay has updated the user agreement but has come under attack from public
Recent public outcry has prompted Chinese remittance provider Alipay to promise sweeping changes to the way the company handles users' personal data.
Earlier this week, a digital spending profile that uses Alipay customers' mobile purchase history went live, sparking outrage among users who accused the company of burying its customer data permissions in fine print.
The profile feature was made available to Alipay's 520 million users on Wednesday and allowed app users to review their 2017 purchase and transaction history. However, a tiny section with a default opt-in hidden at the bottom of the transaction landing page featured an agreement that automatically enrolled customers in Alipay's credit rating service if they swiped up to review their spending history.
In a post on Chinese social media site Weibo, lawyer Yue Shenshan told his followers about the feature, claiming that by agreeing to the privacy policy, users were giving Alipay authorization to collect personal information and sell it to third parties.
Shenshan's post quickly went viral, causing an outcry from Alipay users who depend on the service to make money transfers and international payments.
In response, Alipay issued a statement apologizing for the episode and assuring users that changes were made to the app settings and user agreement almost immediately. China's leading e-wallet app also gave users detailed instructions on how to go about revoking consent they had given unwittingly.
Though the company claims it acted quickly and decisively to correct the issue, many Alipay users have been less than impressed with the company's efforts.
Customers have accused the international money transfer provider of deliberately obscuring a data breach that could have compromised hundreds of millions of users' personal information, and many argue that rather than a default opt-in Alipay should have given customers the option of manually accepting or rejecting the privacy policy before continuing in the app. At the very least, they should have made the agreement more explicit rather than concealing it in fine print at the bottom of the page.
Under China's cyber security legislation, companies are allowed to collect consumer data but they are solely responsible for ensuring that data is handled appropriately, including how it is used, stored and destroyed.
The Alipay issue highlights a broader problem for consumers, who are frustrated by what they see as companies' lack of transparency when it comes to collecting and using personal information.
Analysts see similar problems arising in the future, as more and more user data is spread across different apps, platforms and devices.
Like other countries around the world facing increased consumer demand for cyber security from the companies they deal with, China is working to strengthen its data protection protocols through legislation and law enforcement, but there's still a long way to go. According to Jiang Yongwei, a partner at Jiangsu Xinsu Law Firm in China, companies need to work on creating and rolling out stricter rules for obtaining user consent and giving consumers the right to request that their information be removed from internet search results.
