Incident #B3B4E1 · 06 AUG 2026notable
WeChat EU privacy policy adds anti-fraud processing for Weixin interactions, Malaysia servers and more detailed legal bases
The EU WeChat policy now says that, in certain jurisdictions, some data is processed for anti-fraud and safety in relation to an 'Interoperable Interaction' with Weixin. It adds Malaysia as a server location and WeChat Malaysia Sdn. Bhd. as a group company, and lists a face-encoding vector (ID verification) retention period. It also specifies the transfer safeguards for China, Hong Kong, Malaysia, Singapore and the US, lists security measures, and adds a clause deeming consent where contract or legitimate interest is not recognized as a legal basis. Retention periods, remote support access from the Chinese Mainland and Weixin interoperability were already in the old policy.
Taken from you
- Additional processing of account, profile, contacts, log, location and ID-verification data for anti-fraud in relation to Interoperable Interactions, with extra retention (1-3 months)
- In jurisdictions that don't recognize contract or legitimate interest as a legal basis, consent to processing is deemed given by accepting the policy
Won back
- The policy now names the countries (China, Hong Kong, Malaysia, Singapore) covered by Art. 46 GDPR safeguards and says US transfers to Twilio rely on the EU-US Data Privacy Framework adequacy decision.
- The policy adds a fuller list of security measures, including resilience controls, data minimization and regular testing of safeguards.
- Legitimate interests are now also stated as a legal basis for several categories (profile data, profile media, contacts, location data, security information).
Evidence · 4 of 4 quotes matched in source
Where applicable and only in certain jurisdictions, we process certain information for account safety, anti-fraud and platform integrity purposes in relation to an Interoperable Interaction.+ inserted · ✓ matched in source
To the extent the laws in your jurisdiction do not recognize the legal basis of performance of a contract or legitimate interest, you consent to the processing of your Personal Information for that purpose by consenting to the processing in this Privacy Policy.+ inserted · ✓ matched in source
For transfers to the Chinese Mainland (limited to remote technical support purposes and the purposes set out under "Interoperability with Weixin" in the section entitled "Who do we share your data with?"), Hong Kong SAR, Malaysia and Singapore, we do not rely on an adequacy decision from the EU or UK.+ inserted · ✓ matched in source
Location data shared via chat is deleted after 72 hours from the time of your sharing.+ inserted · ✓ matched in source
Archived version ↗ · 2,351 words changed