China’s biggest online payment company offers its hundreds of millions of users a breakdown on their spending each year, showing everything from their environmental impact to their ranking among shoppers in their area. Many spenders — not shy, and occasionally even a bit boastful about their personal finances — in turn share the details on social media.
This year, the marketing stunt has run into a problem: China’s growing sense of personal privacy.
Ant Financial, an affiliate of the e-commerce giant Alibaba Group, apologized to users on Thursday after prompting an outcry by automatically enrolling in its social credit program those who wanted to see the breakdown. The program, called Sesame Credit, tracks personal relationships and behavior patterns to help determine lending decisions.
That Sesame Credit program is part of a broader push in China to track how people go about their day, one that could feed into the Chinese government’s ambitious — and, some people would say, Orwellian — effort to use technology to keep a closer watch on its citizens.
The episode was a rare, public rebuttal of a prevailing trend in China. The country’s largest internet companies, and the government itself, have gathered ever more data on internet users. While Chinese culture does not emphasize personal privacy and Chinese internet users have grown accustomed to surveillance and censorship, the anger represents a nascent, but growing, demand for increased privacy and data protections online.
Fueled in part by widespread internet fraud and personal information theft, the call for privacy, if it continues, could become a major challenge to China’s internet titans, and eventually to the cyber-authoritarian aspirations of the Chinese government itself.
China has long had high levels of surveillance, from ubiquitous closed-circuit cameras in its big cities to the monitoring of much of its citizens’ online communications. But such efforts have proliferated as new technologies like facial recognition have begun to be rolled out and artificial intelligence has made crunching vast amounts of data much easier.
For now, it is far from clear that this rising discomfort will give way to policy changes. Many Chinese people, even as they express concerns about how companies use their data online, offer little criticism of Beijing’s desire to use that data to help compile a broad social tracking system that rewards what it regards as good citizens and punishes others.
Still, recent signs indicate Chinese consumers are beginning to express some of the same privacy concerns long found in the United States and elsewhere.
This week, one of China’s most visible business leaders bemoaned what he said was a lack of privacy in China in general, and specifically on the country’s most widely used mobile chat service, WeChat.
“There’s no privacy and information security these days,” Li Shufu, the chairman of Geely Holding Group and Volvo Cars, said at a New Year’s forum. “When you walk on the road, there are surveillance cameras everywhere.”
“Pony Ma must be reading our WeChat messages every single day,” he added, referring to the founder of Tencent, the Chinese internet giant that runs the social media and chat app, which has almost one billion users.
In a statement, Tencent said that the company did not store the chat history of users and that it would never use chat history for big data analytics. The comments were met with widespread disbelief: WeChat users have been arrested over what they’ve said on the app, conversations have turned up as evidence in court proceedings, and activists have reported being followed based on WeChat conversations.
“It has become a default setting for me now to assume that we have no privacy in the face of Alibaba and Tencent,” said Li Luyao, a college student in Beijing.
Mr. Li said he did not believe Tencent’s assurances that it was not storing chat logs, and he expressed anger at Ant Financial for resorting to what he called “old tricks.”
In its end-of-year feature, Ant Financial had customers click through a screen with a line in small font saying the user agreed to the terms of service, which were hidden. A toggle was on by default to indicate that the user agreed, and enrolled them in the Sesame Credit program.
Ant Financial said in the terms of service that it reserved the right to share the data it collected with third parties — including government agencies assembling a state-sanctioned social credit system — and could not be held responsible for what happened after it shared the information.
In its statement, Ant Financial said users should have had to actively change the toggle to indicate they agreed, and added that it would remove all of those who had been inadvertently added to the credit system.
User complaints went beyond the narrow concern over how they joined, to broader questions regarding what they were asked to join.
“The tone of the agreement makes me feel so uncomfortable because every sentence literally goes, ‘If this happens, we are not responsible, if that happens, we are not responsible,’” said Zhou Yang, a 25-year old investment professional in Shanghai. “They sound like sneaky unscrupulous merchants who will sell your data and don’t want to be responsible for anything, and you have to agree to all of it.”
Ms. Zhou’s fears about data sales underscore more widespread worries about controlling personal information. China’s official media have reported an increasing number of cases of internet fraud, and personal data is widely available for sale through online marketplaces. A 2017 survey by China’s state-run Beijing Youth Daily found that leaking personal data was the No. 1 concern among consumers.
The issue has filtered to the top of the Chinese leadership. Even as Beijing continues to assemble one of the most sophisticated and wide-scale surveillance systems in the world, politicians have called for better privacy protections. Laws have been beefed up to better protect consumer data. And it has had an impact overseas, too: Ant Financial’s deal to buy MoneyGram, the money-transfer company, collapsed amid concerns in the United States over a Chinese company having access to a large amount of financial data.
In part, the Sesame Credit moves by Ant Financial might have been trying to get around newer, stricter laws that would prevent them from sharing user data unless they had explicit permission, said Zhai Zhenyi, a lawyer at Yingke, a China-based law firm.
“Problems like telecom fraud and malicious marketing have severely vexed the general public, so people’s consciousness about their rights is awakening,” he said. “This is a very good thing to see.”
That consciousness may not extend to government collection of data, even though China’s biggest internet companies often provide user information to Beijing.
Ant Financial’s credit system resembles one the government itself plans to soon implement.
Beijing has said it will introduce in 2020 its own social credit system that is expected to give and take away privileges based on spending habits, online and real-world behavior, and social relationships. Foreign travel, speedy internet, school access, and social benefits could all be granted or denied based on a person’s score. The government system will most likely be at least partly dependent on data collected by companies like Alibaba and Tencent.
It is unclear how many Chinese are truly against such programs.
Mr. Li, the Beijing college student, said that many of his friends still shared the shopping breakdowns — which now include a number indicating a user’s Sesame Credit score.
Such is the power and ubiquity of Alibaba and Tencent in China, he added, that customers would find voting with their feet and quitting the services difficult.
“Being angry doesn’t do us any good,” he said. “Maybe you can stop using Alipay if you are angry, but there’s no way you could stop using WeChat.”