Zalo

The Verification Workflow in Action

Opening the Zalo app for the first time presents a straightforward registration screen. The user enters a phone number and requests a verification code via SMS. The process seems simple. However, the reality is more complex. Many users report that the verification SMS never arrives, leaving them unable to register. For those who succeed, the next step involves providing personal information. The app requests access to contacts, location, and storage. In Vietnam, account verification has become stricter. Zalo now requires facial and voice recognition via automated video calls for account verification. This is part of compliance with the Personal Data Protection Law of 2025. The app also requires users to accept its terms of service. These terms have been a major point of contention. Users are given a binary choice: accept all terms or delete the account. The terms grant Zalo broad rights to collect and share personal data, including phone number, full name, gender, family relationships, and citizen identification information. Failure to accept results in automatic account deletion after 45 days. The verification workflow is designed to secure the platform, but it comes at a significant cost to user autonomy.

Encryption Promises vs. Data Collection Reality

Zalo promotes itself as a privacy-focused app with end-to-end encryption, disappearing messages, and instant recall. These features suggest a strong commitment to user privacy. However, the app's data collection practices paint a different picture. The updated terms of service significantly expand Zalo's rights to collect, process, and utilize user data, including behavioral data. The platform collects location information, contact info, contacts, user content, and identifiers. Critics argue that Zalo resembles WeChat in its social centrality but lacks the robust legal safeguards found in Europe. The platform was fined VND810 million (approximately US$32,000) for violating consumer rights and mishandling user data. The National Competition Commission found that VNG failed to provide users with adequate options to consent or refuse when it came to sharing their personal information. This creates a paradox: users are promised privacy through encryption but are required to accept broad data collection. The encryption protects message content, but the metadata and personal information collected can still be used for advertising and other commercial purposes. This tension between privacy promises and data collection reality is a defining characteristic of the Zalo experience.

What Actually Changed in Recent Updates

The version history shows a pattern of incremental updates with generic changelogs. Version 26.08.01, released in August 2026, includes the standard note: "Zalo has fixed some bugs and improved performance for a smoother experience". Version 26.04.02, released in May 2026, carries the same message. The APK size varies across versions, ranging from approximately 63 MB to 109 MB. The app supports Android 7.0 and above. The updates have not addressed the core complaints. Users continue to report notification issues, poor voice call quality, and crashes. One user noted: "App lỗi ko fix, dùng 1 ngày lỗi 2 lần quá chán" (The app has many bugs, crashes twice a day). Another reported a white screen at the chat bubble and inability to turn on the keyboard. The updates have focused on stability, but the fundamental issues remain. The app has also seen changes in its ranking. It dropped out of the top 200 free apps on Google Play in Vietnam. On the App Store, its average rating dropped to 2 stars, down from 3 stars the previous week. The number of one-star reviews increased significantly. The updates have not reversed this trend.

The Curious Case of the 2,000-Character Limit and Emoji Corruption

Zalo's API enforces a 2,000-character limit for messages. This is a standard limitation for many messaging platforms. However, a specific bug has been identified. Outbound messages containing emoji near the 2,000-character limit could be delivered with a corrupted final character. Messages or photo captions that are exactly 2,000 characters long and end with an emoji may be delivered with a broken character. This is a niche but frustrating issue for users who rely on Zalo for detailed communication. The bug has been addressed in a pull request. However, it highlights the technical challenges of supporting emoji in a platform with strict character limits. The issue is not widely known, but it represents the kind of technical detail that can disrupt user experience. For users who frequently send long messages with emoji, this bug could be a significant annoyance. The fix ensures that outbound text and captions are kept UTF-16 safe. This technical detail is a reminder that even established platforms like Zalo have unique quirks that can affect user experience.