The National Privacy Commission has launched a preliminary investigation into the “Buo ang Saya ng Pasko” Christmas campaign of Jollibee Foods Corporation on the messaging platform Viber, following complaints that branded content appeared within private chat interfaces.

In a statement issued Tuesday, the NPC said it has taken cognizance of media reports and user feedback claiming that automated greetings, digital stickers, and other marketing materials associated with the campaign surfaced in private conversations, prompting questions about the boundaries of digital marketing in personal communication spaces.

The Commission confirmed that it has sought explanations from both Jollibee and Viber to clarify how the campaign was conceptualized, deployed, and technically implemented, and whether its execution involved the processing of personal data under the Data Privacy Act of 2012.

“The Commission is currently determining whether the campaign’s implementation involves personal data processing and, if so, whether such processing complies with the requirements of the Data Privacy Act,” the NPC said.

Under the law, personal information controllers engaged in direct marketing must ensure that all data processing is grounded on the principles of transparency, legitimate purpose, and proportionality. Where personal data are used, consent must be specific and freely given, and data subjects must be informed of their right to object to the processing of their information for marketing purposes.

The NPC noted that private messaging platforms are generally regarded as high-expectation privacy environments, and marketing initiatives deployed within such spaces require heightened safeguards to ensure that users retain meaningful control over their personal data.

The Commission emphasized that the investigation is fact-finding in nature and does not, at this stage, constitute a determination of liability or a finding of a data privacy violation.

“As digital marketing strategies continue to evolve, the NPC’s role is to ensure that innovation does not come at the expense of fundamental privacy rights,” the Commission said.

Jollibee Foods Corporation and Viber have yet to issue public statements responding to the NPC’s inquiry as of posting time.