The situation: Customers register on a small shop's app and provide phone numbers and addresses only for delivery. Later the shop sells or shares this data with advertisers, and customers start receiving unwanted marketing messages and calls. Several file complaints and ask to see what data was collected and to have it deleted.
Applicable law: Under the Personal Information Protection Law and the Data Security Law, personal data must be collected with clear consent for a specific, stated purpose, kept secure, and not used or shared beyond that purpose. Users also have the right to access, correct, and delete their data and to withdraw consent.
Typical outcome: The shop is required to stop the unauthorised sharing, let users access and delete their data, and correct its practices; it may face administrative liability if it fails to comply.
· Awareness case
An App Using Customer Data Beyond the Stated Purpose · Yalla China
🤝 Governing law: 个人信息保护法 / 数据安全法 / Personal Information Protection Law & Data Security Law
A small app-based shop collects customers' phone numbers and addresses for delivery, then shares them with advertisers without consent; users complain and ask to access and delete their data.
Illustrative, general educational examples — not real specific facts and not legal advice; for awareness only. For an actual situation, consult a licensed lawyer.
🎓 The lesson / takeaway
Lesson: Collect customer data only with clear consent and for a specific purpose, protect it, and do not share it beyond that purpose. Respect users' rights to access and delete. As a user, read the privacy policy and check permissions before agreeing.
🕒 Updated: 16 March 2026