Privacy watchdog clears Jollibee’s Christmas ads
Jollibee Foods Corp. and Rakuten Viber did not violate the country’s data privacy law in conducting their 2025 Christmas campaign, which involved stickers automatically appearing in private chats. This is according to the National Privacy Commission (NPC).
In a statement on Tuesday, the NPC said its investigation—started in January—found “insufficient indicators of personal information processing” in the “Holiday Gems Christmas Campaign.”
The fast food giant launched the campaign on the Viber messaging app.
Had the campaign involved the processing of personal data, the commission would have had to determine whether both companies complied with the Data Privacy Act of 2012.
Instead, the NPC’s Complaints and Investigation Division found that the campaign “operated through contextual, on-device matching mechanisms using predefined keywords stored locally within the application.”
“This process ensured that animated visual elements were deployed at the device level without transmitting message content to external servers for keyword detection,” it added.
The probe stemmed from Jollibee’s holiday campaign on Viber, which automatically triggered festive branded stickers in private chats whenever users typed the word “Christmas” in conversations.
The sticker bore the message “Have a Jolly Christmas!” alongside the Jollibee logo. It appeared in both chat groups and personal messages during the holiday period.
The NPC said the findings were based on its independent testing and evaluation of the application.
“Furthermore, the investigation confirmed that campaign delivery parameters were based on country codes rather than geographic tagging or user location data,” the commission added.
After receiving complaints about the “intrusive” advertisements, the NPC launched its investigation in early January. This was intended to determine whether the campaign violated provisions of the Data Privacy Act governing direct marketing and the processing of personal information.
Under the law, personal information controllers are required to ensure that marketing activities involving personal data comply with the principles of transparency, legitimate purpose and proportionality.
Moving forward, the NPC urged the public to continue reporting activities that may involve questionable processing of personal data.
“The public is advised to remain vigilant and to continue reporting any suspicious data processing activities to the NPC and appropriate authorities to ensure the continued protection of their personal information and privacy rights,” it said.
