Following the entry into force of the Law on Protection of Consumer Rights 2023 (“LPCR 2023”), law enforcement trends are showing a clearer trajectory: regulatory authorities are not only looking at whether businesses issue appropriate policies or contracts, but are increasingly focusing on how those provisions are implemented in practice.
In the initial period after the LPCR 2023 took effect, the VCC primarily carried out guidance activities for businesses, requested amendments to standard form contracts and general trading conditions, and issued numerous advisory documents to support businesses in perfecting their compliance mechanisms. However, sanctioning decisions published from late 2025 and throughout 2026 reflect a significant shift in law enforcement approach. Rather than merely requesting corrective action, the VCC has imposed administrative fines of relatively substantial amounts, while simultaneously requiring businesses to cease violations, amend standard form contracts and general trading conditions, and refine internal policies before further practical application.
Notably, the focus areas span widely—from standard form contracts, general trading conditions, and consumer disclosures to the collection and use of consumer information, digital marketing activities, and collaborations with KOLs/KOCs. This demands that businesses comprehensively review the entire “consumer journey” rather than addressing individual documents in isolation.
From an advisory perspective, ATA Legal Services considers this the pivotal moment for businesses to proactively redesign their compliance systems for risk prevention, rather than merely attempting remediation when inspections, complaints, or disputes arise.
I. KEY VIOLATION GROUPS AND FUNDAMENTAL BUSINESS MISCONCEPTIONS
1. First Group of Violations: Failure to establish mechanisms for consumers to opt into/out of information usage for advertising and marketing purposes
Previously, when referring to customer data collection, most businesses only concerned themselves with personal data protection regulations. However, recent enforcement practices by the VCC highlight a new compliance requirement: the use of consumer information for advertising and marketing purposes is governed not only by personal data laws, but also directly by LPCR 2023.
From our experience advising enterprises operating in technology, e-commerce, retail, and services, ATA has observed that many businesses maintain inaccurate or incomplete understandings:
- First, equating "consent to data processing" with "consent to receive advertising." This is the most common misconception. Many websites only feature a single selection box: "I agree to the Privacy Policy." Subsequently, the business uses the consumer's email address or phone number to send marketing materials. However, under LPCR 2023, a consumer’s consent to data processing does not mean consent to receive marketing messages. These two distinct purposes must be presented via separate, independent choices.
- Second, using default consent mechanisms. A number of websites and applications still design pre-ticked checkboxes or stipulate that continued use of the service implies agreement to receive marketing activities. This design poses a significant risk of failing to guarantee the consumer’s genuine right to choose.
- Third, lacking a mechanism to withdraw consent. Numerous businesses allow consumers to opt into receiving advertising, yet fail to provide a simple method to opt out or unsubscribe. This diminishes the substantive nature of the right to choose and may serve as an adverse factor when regulatory authorities assess the overall level of compliance.
2. Second Group of Violations: Including prohibited provisions in standard form contracts and general trading conditions
In almost all digital transactions today, consumers have virtually no opportunity to negotiate with businesses. With a single click on "Agree," consumers accept all pre-drafted terms of use, membership policies, general trading conditions, or contracts provided by the enterprise. Due to this characteristic, the law treats standard form contracts as the area carrying the highest risk of imbalance between the interests of businesses and consumers.
A common reality is that many Vietnamese businesses construct their Terms of Use, Membership Policies, or General Trading Conditions by referencing international platforms or templates available on the Internet. Typically, these contracts integrate terms with explicit bias toward the business, such as: "the enterprise reserves the right to unilaterally modify contract terms upon the occurrence of appropriate events", "the enterprise disclaims all liability", or "the consumer is deemed to accept if they continue using the service". These are all terms "prohibited from being included in contracts entered into with consumers" under Article 25 of LPCR 2023, serving as the direct cause for many businesses being sanctioned in recent times.
3. Third Group of Violations: Violations arising from the conduct of KOLs and celebrities
For years, Influencer Marketing—promoting products through celebrities, Key Opinion Leaders (KOLs), Key Opinion Consumers (KOCs), Affiliate Partners, or Content Creators—has been viewed by businesses primarily through a commercial and media lens. Business priorities usually focused on: selecting influencers aligned with the brand, media efficacy, conversion rates, ad content control, and PR crisis management.
In recently investigated and sanctioned cases, we believe the VCC is sending three very clear and specific messages:
- First, the VCC views Influencer Marketing as a legal activity and a conditionally compliant business operation. This means businesses cannot view KOL/KOC collaborations merely as marketing campaigns.
- Second, legal liability does not lie solely with the influencer, but primarily with the sponsoring business.
- Third, regulatory authorities are evaluating the entire collaboration workflow. As a result, not only post content, but also contracts with KOLs/KOCs, content approval workflows, control mechanisms, and sponsorship disclosure methods are subject to scrutiny.
It is evident that the VCC is progressively shifting from inspecting individual advertisements to evaluating an enterprise's entire compliance management framework. This requires a vital shift in how businesses approach marketing: rather than merely reviewing content after it is created, compliance requirements must be embedded right from the campaign design phase.
II. FIVE INSPECTION AND ENFORCEMENT TRENDS IN CONSUMER PROTECTION – WHAT BUSINESSES NEED TO NOTE
1. From document audits to operational compliance checks
Contracts, terms of use, and policies constitute only a portion of a compliance system. In practice, when conducting compliance reviews as a basis for sanctioning decisions, the VCC will not merely examine the published content of contracts or policies. Instead, it will evaluate how businesses actually execute those policies on websites, applications, real-world operational workflows, customer feedback logs, and grievance handling records.
This means that even if a policy is comprehensively drafted, failing to implement it correctly or failing to ensure consumers' substantive right to choose can still result in administrative penalties.
Therefore, businesses must not only focus on building internal compliance rules and procedures, but also place heavy emphasis on managing actual implementation. This includes training and supervising staff and corporate representatives throughout execution, as well as regularly updating and amending terms to align with new legal provisions.
2. Consumer rights regarding personal data become a compliance focal point
Recent sanctioning decisions demonstrate that the VCC is paying particular attention to how businesses utilize consumer information for advertising, marketing, and other commercial purposes. The regulatory focus has shifted from whether a business collects data to whether it establishes mechanisms for consumers to choose and control how their data is used.
Accordingly, businesses should note:
- Clearly distinguish between data collection/processing and the use of data for advertising, marketing, and other commercial purposes.
- Design mechanisms that allow consumers to select, modify their selections, and withdraw consent in a clear and convenient manner.
- Review data collection, processing, and management practices holistically across websites/apps, marketing strategies and programs, and customer relationship management (CRM) and care activities.
3. Standard form contracts and general trading conditions must be reviewed to ensure substantive consumer rights
Many enterprises still regard Terms of Use, Membership Policies, or General Trading Conditions purely as internal legal documents. Aside from certain mandatory contracts and general conditions that require registration with competent authorities, they assume other documents are purely civil matters, freely negotiated and agreed upon by the parties.
However, recent enforcement decisions reveal that the VCC considers this a top-priority inspection area. Including unfair terms or failing to fully disclose them can result in both administrative fines and the invalidation of those terms against consumers.
Businesses must pay close attention to:
- Inspecting and modifying clauses concerning unilateral amendment rights, disclaimers of liability, service termination, refunds, dispute resolution, and any content that creates an unfair imbalance detrimental to consumers.
- Verifying disclosure obligations, effective dates, delivery methods, and consumer accessibility regarding these contracts and general conditions.
4. Influencer Marketing has officially become a legal matter
Corporate sponsorship of KOLs/KOCs is no longer just a marketing campaign. Under LPCR 2023, it has become a formal legal activity governed by strict compliance duties. The VCC is enforcing liability directly on sponsoring businesses, rather than focusing solely on the influencers themselves.
At this stage, businesses need to:
- Exercise strict control over contracts, promotional content, mandatory disclosure of financial relationships, and pre-publication approval workflows.
- Delineate responsibilities clearly among the business, marketing agencies, and influencers, while establishing mechanisms to address non-compliant content.
- Develop a public relations crisis management protocol coupled with legal risk management.
5. Risks frequently cluster across multiple touchpoints, leading to multi-violation sanctioning trends
A notable pattern in recent enforcement decisions is that they rarely target a single isolated violation. In many cases, enterprises are cited for multiple simultaneous infractions concerning consumer data protection, standard form contracts, general trading conditions, and product promotional activities. This reflects the regulatory authority's holistic approach to evaluating corporate compliance frameworks.
Consequently, reviewing documents in isolation is insufficient to identify comprehensive exposure. Instead, businesses require a cross-departmental compliance governance mechanism with designated lead responsibilities, updated periodically to mitigate legal risks effectively.
III. HOW CAN ATA ASSIST BUSINESSES IN COMPLIANCE MANAGEMENT UNDER THE LPCR 2023?
ATA does not merely help businesses “amend a single clause” when an issue arises. Leveraging our accumulated expertise and insights, we partner with enterprises to design and operate a tailored compliance system aligned with their specific business models.
1. Comprehensive Compliance Review
ATA assists businesses in conducting holistic reviews and assessments of their websites/apps, standard form contracts, general trading conditions, privacy policies, sales workflows, marketing activities, customer care operations, and consumer touchpoints. Through this, we identify compliance gaps and risk levels while recommending effective remediation strategies.
2. Reviewing and Standardizing Contracts and Policies
ATA reviews and amends Terms of Use, general trading conditions, service agreements, membership policies, cancellation/refund policies, grievance handling mechanisms, and other consumer transaction documents to ensure full alignment with LPCR 2023 provisions and regulatory guidance.
3. Designing Compliance Mechanisms for Data Management and Marketing
ATA supports businesses in reviewing, evaluating, and standardizing data collection and usage flows; designing consumer consent/opt-out mechanisms; and auditing email/SMS/app marketing, CRM workflows, loyalty programs, and data-sharing activities.
4. Mitigating Risks from Influencer Marketing
ATA directly reviews contracts with KOLs, KOCs, Creators, and Affiliate Partners; drafts liability allocation terms; designs content approval checklists and procedures; and enforces sponsorship disclosure obligations.
5. Building a Compliance Governance Framework
ATA collaborates with internal business departments to establish operational workflows, cross-functional responsibility matrices, control checklists, and coordination mechanisms connecting Legal, Business, Marketing, IT, and Customer Service teams.
6. Training and Legal Updates
ATA deploys experienced lawyers and legal experts to train relevant departments on internal procedures, standardized contract templates, and practical issue resolution.
Additionally, ATA assists enterprises in keeping abreast of legislative changes, supporting periodic self-audits and non-compliance remediation to prevent operational risks.
IV. CONCLUSION
Sanctioning decisions published by the VCC in recent times demonstrate that the LPCR 2023 is entering a new enforcement era. Regulatory focus is no longer limited to addressing isolated infractions, but is moving toward a comprehensive evaluation of an enterprise's overall compliance governance framework.
Based on recent enforcement trends in consumer protection, ATA Legal Services believes it is time for businesses to shift from a mindset of "act first, rectify when cited" to "act only after establishing a compliance risk management system"—transitioning completely from mere "on-demand compliance" to "treating compliance governance as a competitive advantage." In practice, enterprises that proactively build effective compliance governance systems will not only mitigate the risk of administrative sanctions, but also enhance transparency, foster consumer trust, and lay a solid foundation for sustainable growth in the digital economy.
With a team of seasoned lawyers and experts with extensive multi-industry experience, ATA Legal Services stands ready to accompany enterprises in reviewing, designing, standardizing, and operating compliance governance systems. Our solutions are tailored not only to current statutory requirements, but also to the specific characteristics of every sector, industry, and business model—ensuring legal risk management runs parallel with and serves as the foundation for sustainable business strategies.
Comment: