[Edaily Reporter Kim Hyun-ah ] The Seoul YMCA Citizens’ Mediation Center has filed a complaint with the Personal Information Protection Commission (PIPC) against Kakao’s ( Kakao(035720)) corporate advertising service, “Brand Message,” alleging violations of the Personal Information Protection Act. The key issues are whether it is lawful for the service to cross-reference customer phone numbers received from advertisers with KakaoTalk member information, and whether it is lawful to provide advertisers with data on ad views and clicks.

The Seoul YMCA announced on the 12th that it had submitted a complaint to the Personal Information Protection Commission alleging violations of the Personal Information Protection Act regarding Kakao’s operation of “Brand Message.” It requested an investigation into the service’s operational structure and personal information processing procedures, and asked that corrective orders and fines be imposed if any violations are confirmed.

Brand Messages is a service that allows companies to send promotional messages to users who are not KakaoTalk Channel friends, based on customers’ consent to receive marketing communications. While the existing “Friend Talk” service sent advertisements primarily to Channel friends, Brand Messages is characterized by expanding the target audience to include customers who have given their consent to receive marketing communications from the client company.

SMS Advertising Consent Extends to KakaoTalk Ads?…Key Issues Under the Information and Communications Network Act

The first issue concerns the scope of consent to receive advertisements. The Seoul YMCA raised concerns about cases where some companies sent advertisements via KakaoTalk to customers who had only consented to receive SMS advertisements. The question is whether consenting to SMS advertisements can be interpreted as consent to receive KakaoTalk advertisements as well.

The relevant legal provision is Article 50 of the Act on Promotion of Information and Communications Network Utilization and Information Protection, etc. In principle, explicit prior consent from the recipient is required to transmit commercial information for profit. Whether the actual content of the consent matches the delivery medium is a key issue in determining legality.

The second issue concerns the use of personal information for purposes other than those for which it was originally collected. The Seoul YMCA argued that Kakao may have used personal information contrary to its original purpose of collection when cross-referencing customer phone numbers received from advertisers with KakaoTalk member information to identify advertising recipients. They also raised concerns about the process of generating and providing advertisers with data on users’ interactions with ads, such as views and clicks.

In this regard, the Seoul YMCA cited Article 18 of the Personal Information Protection Act. In principle, a personal information processor may not use or provide personal information beyond the scope of the purpose for which it was collected. Provisions related to the provision of personal information to third parties under Article 17 of the Personal Information Protection Act were also raised as an issue.

However, the legal determination may vary depending on whether the advertiser obtained the customer’s consent to receive marketing communications and outsourced the mailing operations to Kakao, or whether Kakao engaged in separate acts of using or providing personal information.

Kakao reportedly maintains that it processes the mailing operations based on the marketing consent obtained by its client companies and that phone numbers are destroyed immediately after matching. Whether there was an actual violation can only be determined after verifying the structure of personal information processing and the details of the consent.

130,000 Spam Reports… “The Right to Opt Out in Bulk Must Be Guaranteed”

The Seoul YMCA also cited the increase in spam reports since the introduction of Brand Messages as a problem. Citing data from the office of a lawmaker on the National Assembly’s Science, Technology, Information, Broadcasting, and Communications Committee, the organization stated that spam reports related to Brand Messages totaled 132,116, and that reports had increased 2.5-fold in just seven months this year.

It also presented data showing that 18 out of 22 (81.8%) of the administrative fines imposed on advertisers this year involved cases where the medium used to send the messages differed from the one for which consent had been obtained. The Seoul YMCA argued that while advertisers face sanctions for running ads using Kakao’s services, the responsibility of the platform operator has not been adequately addressed.

In a user perception survey conducted by the Seoul YMCA, only 16% of respondents considered it appropriate to send advertising messages from individual companies via KakaoTalk without prior consent. Meanwhile, 69% of respondents said government regulation of such practices was necessary. However, the press release did not provide details on the survey methodology, such as the target audience or sample size.

The Seoul YMCA demanded that the Korea Information Privacy Commission (KIPC) conduct a thorough investigation and improve the system to allow users to opt out of receiving brand messages en masse. The organization argues that if any violations are confirmed, sanctions—such as corrective orders and fines—should be imposed, and measures to protect users must be established.

This complaint raises questions regarding whether consent to receive advertisements actually extends to the specific media through which they are sent, and whether a separate legal basis is required for advertising platforms to cross-reference customer information and process response data. It remains to be seen whether the scope of responsibility for advertisers and platform operators will be clarified through the PIP’s investigation and legal rulings.