MANILA, Philippines — The National Privacy Commission (NPC) has officially cleared Jollibee Foods Corp. and Rakuten Viber of any data privacy violations regarding their 2025 “Holiday Gems” Christmas campaign. On Tuesday, April 28, 2026, the commission released findings from a four-month investigation, concluding that the campaign did not unlawfully process personal user information.
The probe was launched in January after users complained about the “intrusive” nature of branded stickers that appeared automatically in private chats.
The investigation centered on a feature where an animated Jollibee sticker with the message “Have a Jolly Christmas!” would trigger whenever a user typed the word “Christmas” in a Viber message.
- On-Device Matching: The NPC’s Complaints and Investigation Division found that the ads used “contextual, on-device matching mechanisms.” This means the app looked for keywords stored locally on the user’s phone rather than scanning and sending message content to external servers.
- No External Transmission: Because the detection happened at the “device level,” private message content was never transmitted to Jollibee or Viber’s main servers for keyword analysis.
- General Targeting: The commission confirmed that the ads were deployed based on broad country codes rather than specific user location data or geographic tagging.
The NPC investigated whether the campaign breached the Data Privacy Act of 2012, which requires marketing activities to adhere to principles of transparency, legitimate purpose, and proportionality.
- Insufficient Indicators: After independent testing, the NPC determined there were “insufficient indicators of personal information processing” to warrant a violation.
- Public Vigilance: While the companies were cleared, the NPC commended the public for reporting the activity, noting that user vigilance is essential for maintaining privacy standards in the digital age.
Although the campaign was found to be legally compliant, the NPC used the ruling to remind corporations of their responsibilities:
- Direct Marketing: Companies must ensure that automated marketing features do not overreach into the personal data of consumers.
- Ongoing Reporting: The commission urged Filipinos to continue reporting any “questionable processing” of data.
The resolution of this case provides a technical precedent for how “keyword-triggered” advertising is viewed under Philippine law, distinguishing between local device processing and server-side data extraction.
