The National Privacy Commission (NPC) has asked Jollibee Foods Corporation (JFC) and messaging platform Viber to explain whether personal data were processed during the fast-food giant’s recent Christmas campaign, following complaints that branded content appeared inside users’ private chats.
The NPC said it took note of media reports and user feedback linked to Jollibee’s “Buo ang Saya ng Pasko” campaign on Viber.
Users reported receiving automated greetings, digital stickers, and other branded materials that surfaced within their chat interfaces, raising concerns over how far digital marketing can extend into ostensibly private online spaces.
The commission said it is now evaluating whether the campaign involved “processing of personal data” as defined under the Data Privacy Act of 2012 (DPA).
Central to the inquiry is whether user information was collected, accessed, or used—directly or indirectly—to deliver the campaign content, and whether such processing, if any, was done with proper legal basis.
Under the DPA, personal information controllers are required to comply with the principles of transparency, legitimate purpose, and proportionality.
For direct marketing activities, consent must be specific, informed, and freely given, and data subjects must be clearly notified of their right to object to the use of their personal information. Failure to meet these standards may expose companies to regulatory sanctions.
The NPC emphasized that it is still in the fact-finding stage and has not made any determination of liability. It said both Jollibee and Viber have been asked to clarify the mechanics of the campaign, including how content was deployed and what data, if any, were involved.
The case highlights growing regulatory scrutiny as brands push deeper into digital and messaging platforms. As marketing increasingly blends into personal communication channels, companies may face tighter expectations on consent, disclosure, and user control—turning privacy compliance into a core reputational and business risk, not just a legal one.
