[2] Compiled from: Southern Metropolis Daily, Red Star News
 
Case review
[3] WeChat Reading is a mobile reading app operated by Tencent Guangzhou Company, allowing users to read books and share book reviews.

 

[4] Last year, plaintiff Ms. Huang accidentally discovered that her WeChat Reading had been linked to hundreds of friends without her knowledge or any active follow actions.
 
[5] On July 30, 2020, the Beijing Internet Court issued a first-instance verdict in the case of "Ms. Huang vs. Tencent Technology (Beijing) Co., Ltd. et al. for network infringement liability," ruling that WeChat Reading obtained WeChat friend relationships without valid user consent, automatically followed WeChat friends, and defaulted to sharing reading information with mutual WeChat Reading users, constituting an infringement on personal information rights.

 
 

[6] According to the verdict, Tencent must stop WeChat Reading from collecting and using the plaintiff's WeChat friend list, delete this list data, terminate the mutual following between the plaintiff and WeChat friends, and cease displaying the plaintiff's reading information to WeChat friends. Additionally, Tencent must issue a written apology to the plaintiff.
 
[1] Highlights of the case
一、 [2] A design that cannot be used without authorization does not violate relevant laws
原告：[3] When logging into WeRead with WeChat, users must authorize once: 1. The user's WeChat nickname, avatar, region, and gender; 2. WeChat friends who also use the app. In fact, although WeRead formally obtained the user's click authorization, this functional design itself constitutes a "disguised coercion" for users to authorize privacy and personal information.

腾讯：[4] WeRead explicitly states in its service agreement that using the service requires WeChat authorization, including the public information of the WeChat account (nickname, avatar, etc.) and finding WeChat friends who also use the app. Moreover, WeRead prompts users on the login page about using their WeChat friend relationships and obtains user consent.

法院：[5] Whether users can make independent choices should be based on fully respecting the wishes of both users and service providers, considering factors such as the substantial impact of the choice on users. If users cannot use the app without agreeing to the collection of certain information, this is the operational model chosen by WeRead. Furthermore, unlike WeChat, which has become an essential social software for the public, users will not feel significant discomfort without using WeRead and can choose other similar products in the market. Based solely on the method of collecting friend lists in this case, Tencent does not violate relevant laws.
 
二、 [6] Automatically adding follows infringes on users' personal information rights and interests.
原告：[1] Without any follow operations, a large number of the plaintiff's WeChat friends appeared on the "People I Follow" page in the account; at the same time, a large number of the plaintiff's WeChat friends also appeared in the "People Who Follow Me" section. The defendant's unauthorized use of the above data to control the plaintiff's account and automatically add follow relationships for the plaintiff not only infringed on the plaintiff's personal information rights but also violated the plaintiff's right to privacy.

腾讯：[2] Regardless of whether it is automatic following, because the user agreed to WeChat Reading accessing their WeChat friend relationships and "finding WeChat friends who also use the app," it means that "following friends" is actually "merely a corresponding reflection of the obtained WeChat friend relationships."

[3] It is worth noting that neither the plaintiff nor the defendant was able to provide decisive evidence proving which party added the existing followers and followed users in the plaintiff's WeChat Reading.

法院：[4] On one hand, Tencent acknowledged the existence of a version with automatic following; on the other hand, it had the ability to provide backend operation instructions for user follow actions and code related to whether automatic follow functionality was designed, but failed to do so. This court accepts the plaintiff's claim and determines that automatic following existed in WeChat Reading. WeChat Reading's automatic addition of the plaintiff's WeChat friends as follows was clearly done without the plaintiff's consent, constituting an infringement on the plaintiff's personal information rights.

[5] However, the court considers that WeChat friend lists and similar information fall under users' personal information but have not yet reached the level of private information. Friend list information includes network identifiers such as WeChat friends' Open_IDs, avatars, and nicknames, which can achieve identification at the level of personal information recognition, but cannot be used to ascertain the degree of the plaintiff's real social relationships with other users, such as closeness or distance, and thus does not reach the level of privacy. Considering only the single act of WeChat Reading collecting WeChat friend relationships, it does not constitute an infringement on the plaintiff's right to privacy.
 
三、 [6] Default display of reading information poses a high risk of infringing on user privacy.
原告：[1] During the use of the software, it was discovered that even if she had no following relationship with her WeChat friends in WeChat Reading, they could still view each other's bookshelves, currently reading materials, reading thoughts, and other information, which she did not wish to disclose to others as private information. The user's reading duration on WeChat Reading, the materials they read, and the book reviews they did not actively publish publicly contain information about the user's reading habits, reading time, lifestyle, and even political stance and values. In this case, this information falls under the category of information the plaintiff did not intend to make public, aligning with the definition of privacy in the draft.

腾讯：[2] The display of the user's reading information was authorized by the user. WeChat Reading not only informed users in documents such as the User Agreement that they could see the reading materials and thoughts shared by WeChat friends but also prompted users in specific usage scenarios. Reading information constitutes personal information, but whether it qualifies as privacy depends on the circumstances. "In particular, reading duration does not belong to privacy, and the books read and his (reading) thoughts... generally do not belong to privacy either," said Zhu Ying, the defendant's attorney from Beijing Global Law Firm.

法院：[3] Although WeChat Reading describes reading information in the user agreement as software usage information, including but not limited to "your bookshelf," "the materials you are currently reading," and other information, the software actually also displays reading duration and other main traces of the user's use of WeChat Reading. Combined, this information can to some extent reveal a person's interests, aesthetic tastes, cultural cultivation, and outline a person's personality profile, which is precisely the basis for extensive social evaluation. Users should have the right to control whether to display this information externally.

[4] Without clearly informing users, WeChat Reading defaulted to sharing users' reading information with WeChat friends who have or do not have a following relationship, which is significantly different from other reading applications that only display information to friends with whom users have voluntarily established a relationship. This does not meet users' reasonable expectations and poses a high risk of infringing on user privacy.

[5] However, the court held that reading information cannot be broadly categorized as privacy. The two books displayed to the plaintiff, "Good Mothers Are Better Than Good Teachers" and "So-Called High EQ Means Being Good at Talking," were insufficient to form a characterization of the plaintiff's personality, did not reach the level of intimacy, and did not constitute an infringement of the user's right to privacy, but rather an infringement of personal information rights.

 

[1] The author's perspective
[6] From a judicial perspective, this case reflects an enhanced protection of individuals. First, for users, it serves as a positive example for individuals to actively protect their personal information rights through civil litigation. Second, it prompts internet companies to pay more attention to compliance reviews of personal information, focusing on compliance in business models and product design, thereby improving the level of personal information protection.
 
The application of the internet, especially personalized services, cannot do without users' personal information, such as location data and preference information. However, internet companies must adhere to the principles of legality, legitimacy, and necessity when using user information, and must also obtain user consent, making further innovations based on ensuring users' right to know and right to choose independently.