THE country’s data privacy regulator is reviewing a Christmas marketing campaign by Jollibee Foods Corp. carried out on messaging platform Viber, after receiving user complaints that branded content appeared inside private chats.
The National Privacy Commission (NPC) said on Tuesday, Jan. 6, 2026, it has taken note of media reports and consumer feedback regarding the “Buo ang Saya ng Pasko” campaign, which featured automated greetings and digital stickers linked to Jollibee on Viber.
According to the NPC, the appearance of branded materials within private chat interfaces has raised questions about the limits of digital marketing and whether personal data may have been processed without proper consent.
The commission said it has sought explanations from both companies and is assessing whether the campaign involved the processing of personal information under the Philippines’ Data Privacy Act of 2012.
“If personal data processing is involved, personal information controllers must ensure compliance with the principles of transparency, legitimate purpose and proportionality,” the NPC said in a statement.
Under the law, companies engaged in direct marketing must secure consent that is specific and freely given and ensure that data subjects are informed of their right to object to the use of their information for marketing purposes, the regulator added.
The review comes as Philippine regulators step up scrutiny of digital platforms and brand partnerships amid growing consumer concern over data privacy, targeted advertising and the use of automated tools in online messaging services.
Jollibee, one of Southeast Asia’s largest fast-food groups, has increasingly turned to digital campaigns and partnerships with technology platforms to reach younger consumers, particularly during peak holiday periods. Messaging apps such as Viber are widely used in the Philippines for personal and business communications.
The NPC said it would determine whether the campaign falls within permissible marketing practices or requires corrective measures under existing data protection rules. / KOC