Data transfers for online advertising purposes enable businesses to reach customers more effectively; however, they also raise significant legal and privacy concerns that must be carefully addressed.
Data transfers for online advertising purposes enable businesses to reach customers more effectively; however, they also raise significant legal and privacy concerns that must be carefully addressed.
I. Current situation of data transfers for online advertising purposes
Today, data transfers for online advertising purposes have become an important tool that enables businesses to reach customers and personalize user experiences. Many businesses rely on behavioral data, preferences, and personal information to optimize advertising campaigns.
However, current practices reveal that, in many cases, data is shared with third parties without users’ knowledge or without obtaining their explicit consent, creating potential privacy and legal risks. The rapid growth of digital advertising platforms and behavioral tracking technologies has further increased the challenges associated with data governance.
II. Understanding data transfers for online advertising purposes
1. What is data transfer for online advertising purposes?
Data transfer for online advertising purposes refers to the use of user information, including email addresses, phone numbers, or browsing histories, obtained from CRM systems or other data sources, to re-engage users on digital platforms such as Facebook, Google, or email channels.
The objective of sũch an activity is to display personalized advertisements, encourage specific actions such as purchasing products, subscribing to services, or downloading applications, while optimizing advertising expenditures and improving conversion rates.
2. What characteristics help identify data transfers for online advertising purposes?
Data transfers for online advertising purposes may be identified through the following characteristics:
- Collection of user behavior-related data: Including website browsing history, search activities, click-through records, content viewing duration, and interactions with advertisements or applications. Such data is generally collected to build user behavior profiles.
- Involvement of third parties: Personal data is often transferred from the original website or application to third parties such as advertising networks, digital marketing platforms, or data analytics companies (e.g., ad networks, DSPs, SSPs).
- Use of data for personalized advertising: Data is analyzed to identify user preferences, predict needs, and deliver advertisements tailored to specific individuals.
- Use of tracking technologies: Data transfers are commonly associated with technologies such as cookies, tracking pixels, SDKs, browser fingerprinting, or embedded tracking codes on websites and applications.
- Automatic and continuous data transmission: Data transfers generally occur automatically and almost in real time, without requiring direct action from users, particularly when users access or interact with online content.
- Sharing information beyond core service provision purposes: Data is used not only for operating websites or applications but also for advertising, remarketing, and measuring advertising campaign effectiveness.
- Disclosure in privacy policies: Data transfer activities are often described in privacy policies through terms such as “sharing data with advertising partners”, “marketing service providers”, or “analytics partners”.
3. What types of personal data are commonly transferred for online advertising?
Online advertising data transfer activities are typically characterized by the collection, analysis, and use of detailed information regarding users’ behavior and preferences (such as browsing history, location data, and demographic information) to facilitate targeted and personalized advertising. Such data commonly includes:
- Identification information (e.g., email addresses and phone numbers);
- Online behavioral data (e.g., clicks, views, searches, and browsing activities);
- User preferences and interests used to display relevant advertisements across digital platforms.
III. Legal regulations governing data transfers for online advertising purposes
1. Conditions for data transfers for online advertising purposes
Pursuant to Article 28 of the Personal Data Protection Law 2025, the protection of personal data in advertising services is regulated as follows:
- Organizations and individuals engaged in advertising services may only use customers’ personal data that has been transferred by personal data controllers or personal data controller-processors under an agreement or collected through their own business activities for advertising service purposes. The collection, use, and transfer of personal data must ensure the rights of personal data subjects prescribed under Article 4 of the Personal Data Protection Law 2025.
- Personal data controllers and personal data controller-processors may transfer personal data to advertising service providers only in accordance with the law.
- The processing of customers’ personal data for advertising purposes must be based on customers’ consent, with customers being fully informed of the content, methods, forms, and frequency of promotional communications. A mechanism must also be provided allowing customers to opt out of receiving advertisements.
- The use of personal data for advertising purposes must comply with regulations on the prevention of spam messages, spam emails, unsolicited calls, and advertising laws.
- Personal data subjects have the right to request the cessation of advertising communications. Advertising service providers must establish mechanisms to facilitate such requests and cease advertising upon request.
- Advertising service providers are prohibited from subcontracting or authorizing other organizations or individuals to perform the entirety of advertising services involving personal data on their behalf.
- Advertising service providers bear the burden of proving the lawful use of customers’ personal data for advertising purposes and must comply with the requirements specified in above Items and other advertising-related laws.
- Organizations and individuals that use personal data for behavioral advertising, targeted advertising, or personalized advertising must additionally comply with the following requirements:
- Personal data may only be collected through the monitoring of websites, web portals, or applications with the consent of the personal data subject;
- Mechanisms must be established to allow data subjects to refuse data sharing, specify retention periods, and ensure deletion or destruction of data when it is no longer necessary.
2. What conduct constitutes a violation when transferring data for online advertising purposes?
Under Article 7 of the Personal Data Protection Law 2025, the following prohibited acts may constitute violations when personal data is processed or transferred for online advertising purposes:
- Processing personal data for activities against the Socialist Republic of Vietnam or activities affecting national defense, national security, public order and safety, or the lawful rights and interests of agencies, organizations, or individuals;
- Obstructing personal data protection activities;
- Abusing personal data protection activities to commit unlawful acts;
- Processing personal data in violation of legal requirements;
- Using another person’s personal data, or permitting others to use one’s personal data, for unlawful purposes;
- Buying or selling personal data, except where otherwise permitted by law;
- Misappropriating, intentionally disclosing, or causing the loss of personal data.
3. What steps are included in the data transfer process for online advertising purposes?
The data transfer process for online advertising purposes generally includes the following steps:
- Step 1: Businesses must clearly identify the advertising objectives, categories of personal data to be transferred, intended recipients, and the scope of data usage.
- Step 2: Businesses determine whether the transferred data constitutes basic personal data or sensitive personal data in order to implement appropriate protection measures.
- Step 3: Data subjects must be fully informed about the transfer of their personal data for online advertising purposes, and such transfers may only be conducted with lawful consent unless otherwise permitted by law.
- Step 4: Businesses should establish contracts or agreements requiring recipients to use the data only for authorized purposes, comply with confidentiality obligations, and refrain from unauthorized onward transfers.
- Step 5: Appropriate technical and organizational measures should be adopted to safeguard personal data during transfer and processing.
- Step 6: Businesses should retain relevant documentation and regularly monitor and audit data usage to ensure ongoing legal compliance.
4. What sanctions may apply for data transfers used for improper advertising purposes?
Pursuant to Article 8 of the Personal Data Protection Law 2025, organizations and individuals that violate personal data protection laws may, depending on the nature and severity of the violation, be subject to administrative sanctions or criminal liability. Violations of personal data protection laws may result in criminal prosecution under the Penal Code 2015 (as amended in 2017), including offenses such as:
- Infringing the secrecy of correspondence, telephone communications, or other forms of private communication (Article 159);
- Illegal provision or use of information on computer networks or telecommunications networks (Article 288);
- Illegal intrusion into computer networks or telecommunications networks (Article 289);
- Illegal collection or trading of bank account information (Article 291).
Such criminal liability may apply where the conduct causes serious consequences and exceeds the threshold for administrative or disciplinary sanctions.
For organizations, the maximum administrative fine is 3 billion VND for ordinary violations. In particular:
- Acts involving the purchase or sale of personal data may be subject to fines of up to ten times the illicit gains obtained;
- Violations involving cross-border transfers of personal data may result in fines of up to 5% of the organization's preceding fiscal year's revenue.
For individuals committing the same violations, the maximum monetary fine is 50% of the fine applicable to organizations.
IV. Questions regarding data transfers for online advertising purposes
1. Is a business required to obtain customer consent before transferring data for online advertising purposes?
Pursuant to Article 5 of the Personal Data Protection Law 2025, data subjects are granted fundamental rights, including the right to be informed (to know how their data is processed), the right to consent (to permit or refuse processing), the right of access (to view and correct data), the right to request deletion, restriction of processing, provision of copies, the right to object, and the right to file complaints, denunciations, or initiate legal proceedings to protect their personal information against unclear, non-transparent, or unwanted processing activities.
Accordingly, where a business transfers personal data to advertising partners for the purpose of conducting online advertising activities, it is required to obtain the lawful consent of customers before collecting, using, or transferring such data.
2. Which authority takes primary responsibility for overseeing data transfers for online advertising purposes?
Pursuant to Article 39 of Decree No. 356/2025/ND-CP, the State has established a specialized mechanism for personal data protection through the creation of the Specialized Personal Data Protection Authority under the Ministry of Public Security. Such an authority is responsible for advising and assisting the Minister of Public Security in performing state management functions relating to personal data protection nationwide.
In addition, the National Personal Data Protection Portal has been established to provide official information regarding Party policies and State laws on personal data protection. The portal also serves as a platform for guidance, awareness-raising, and capacity-building concerning data protection for agencies, organizations, and individuals. Furthermore, it functions as a focal point for receiving and handling complaints, feedback, and recommendations relating to personal data protection, as well as performing other functions prescribed by law.
3. Is it mandatory to assess the suitability of data recipients when transferring data for online advertising purposes?
Under Decree No. 356/2025/ND-CP, assessing the suitability of data recipients is mandatory to ensure that personal data is transferred only to organizations or individuals possessing adequate legal qualifications, data protection capabilities, and the ability to use the data solely for the disclosed advertising purposes.
Such a requirement is necessary to minimize risks of privacy violations and to ensure compliance with personal data protection laws.
4. Is it necessary to control third-party access rights when transferring data for online advertising purposes?
The transfer of personal data for online advertising purposes requires strict control over third-party access rights under Clause 4, Article 29 of the Personal Data Protection Law 2025.
Specifically, the law requires organizations and individuals providing online services to publicly disclose their privacy policies, clearly explain how personal data is collected, used, and shared, and ensure that users retain decision-making authority regarding behavioral tracking and data sharing for advertising purposes.
Furthermore, legal provisions prohibiting the collection or sharing of data beyond the scope agreed upon with data subjects, together with obligations to implement security measures preventing unauthorized access, impose stringent requirements for controlling third-party access to personal data involved in online advertising activities.
V. Why should you seek legal advice from NPLaw regarding data transfers for online advertising purposes?
The transfer of personal data for online advertising purposes is a complex legal area involving significant compliance and liability risks. With extensive experience and specialized expertise in personal data protection and advertising law, NPLaw’s lawyers can assist businesses in ensuring legal compliance, minimizing regulatory risks, and effectively addressing issues that may arise.
NPLaw not only provides legal advice but also partners with businesses in proactively preventing risks and comprehensively safeguarding their lawful rights and interests.
The information provided above is for reference purposes only. Should you require legal advice tailored to your specific circumstances, please contact NPLaw for prompt assistance.
