Online purchase of condoms harassed by delivery personnel: How does the law uphold your "privacy shield"?

In April 2025, Ms. Wang in Chengdu purchased condoms through an e-commerce platform, only to receive a harassing text message from the delivery driver saying, “12 pieces, take care of your health.” The incident sparked intense public concern over privacy protection in online shopping. When privacy breaches intertwine with harassment, how can consumers use legal tools to defend their rights?

I. Legal Characterization: The "Triple Illegality" of Delivery Riders' Harassing Conduct

1. Criminal Risks of the Crime of Infringing on Citizens' Personal Information

According to Article 253 of the Criminal Law, if a delivery person illegally obtains user order information (including product names, addresses, phone numbers, etc.) through system vulnerabilities in the platform, they may be suspected of the crime of infringing on citizens' personal information. In the Chengdu case, although the platform used virtual numbers, the delivery person still obtained real numbers through some means, exposing flaws in system permission management.

2. Administrative penalties under the Public Security Administration Punishments Law

Under Article 42 of the Public Security Administration Punishments Law, sending harassing messages that disrupt another person’s normal life shall result in detention of not more than five days or a fine of not more than 500 yuan; where the circumstances are relatively serious, detention of not less than five days but not more than ten days shall be imposed. In the case of You in Fucheng, a food delivery rider was administratively detained for five days for repeatedly sending sexually suggestive text messages.

3. Compensation Obligations in Civil Tort Liability

According to Article 1165 of the Civil Code, harassing behavior constitutes an infringement on personality rights, and victims may claim compensation for mental damages. If Ms. Wang from Chengdu files a civil lawsuit, she can demand compensation from the delivery person for medical expenses (such as psychological counseling fees), lost wages, and mental distress damages.

II. Rights Protection Path: The "Four-Step" Process from Evidence Preservation to Judicial Remedies

1. Evidence preservation: building an "electronic evidence chain"

Instant screenshots: Save harassing text messages and call logs (which must show the caller's number and timestamp), such as the screenshot of the "12" text message retained by Ms. Wang in the Chengdu case.

Platform Data Retrieval: Request e-commerce platforms to provide order encryption records, delivery personnel identity information, and system operation logs.

Third-party evidence collection: Electronic evidence is preserved through "trusted timestamp" services to prevent platforms from tampering with data.

2. Platform complaints: activate the "internal accountability mechanism"

Dual-Pronged Approach: Simultaneously file complaints with shopping platforms (e.g., Taobao) and delivery platforms (e.g., Ele.me), requesting an explanation of the implementation of the "Privacy Protection Agreement."

Time-limited accountability: Under Article 77 of the E-Commerce Law, the platform shall initiate an investigation within 48 hours, or it may face administrative penalties.

3. Administrative Reporting: Leveraging the "Regulatory Lever"

Postal Administration Complaint: Submit evidence through the "Postal Industry Consumer Complaint" WeChat platform to request a case investigation into the delivery company. Historical cases show that a corporate executive apology can be obtained within 3 days.

Market regulatory authorities intervene: Under Article 56 of the Law of the People's Republic of China on the Protection of Consumer Rights and Interests, the complaint platform failed to fulfill its statutory obligation to “adopt technical measures to protect consumer privacy.”

4. Judicial Remedies: Choosing the "Optimal Dispute Resolution Path"

Private criminal prosecution: If the harassment is accompanied by threats or extortion, a private criminal prosecution can be filed in court to seek accountability under Article 293 of the Criminal Law for the crime of picking quarrels and provoking trouble.

Civil public interest litigation: In cases of systemic platform data breaches, affected individuals may jointly petition the procuratorate to initiate a public interest litigation for personal information protection, as demonstrated by the "first data breach case" heard by the Hangzhou Internet Court in 2023.

III. Determination of Liability: Unraveling the Privacy Protection Puzzle in "Cross-Platform Collaboration"

1. The "source responsibility" of shopping platforms

According to Article 9 of the Personal Information Protection Law, platforms, as data processors, must conduct compliance audits on the data usage of their partners. In the Chengdu case, although Taobao provided privacy-protected shipping labels, it failed to implement tiered access control for the data access rights of partner delivery platforms, making it difficult to evade responsibility.

2. The "last-mile responsibility" of delivery platforms

If a delivery app has technical flaws such as “unencrypted order caching,” it must bear liability for violations under Article 42 of the Cybersecurity Law. Ele.me customer service once responded that “family planning product delivery orders absolutely do not display product details,” but information leaks still occurred in actual operations, exposing technical vulnerabilities.

3. The rider’s “direct liability”

For those who maliciously obtain information, the platform should terminate the labor contract in accordance with Article 39 of the Labor Contract Law and include them in the industry blacklist. In the Chengdu case, the convenience store involved has added the rider to the system blacklist, prohibiting them from accepting any orders.

IV. Preventive Mechanisms: Three Pillars for Building a "Privacy Protection Network"

1. Enhanced Technical Protection

Dynamic virtual numbers: adopting a "one order, one number" mechanism, automatically invalidated upon delivery completion, such as the "Privacy Protection 2.0" system launched by Meituan.

Biometric Pickup: Pilot facial recognition combined with order number dual verification at community self-service lockers to block delivery personnel's access to user information.

2. Improved industry standards

Establish a credit file for delivery personnel: incorporate harassment behavior into personal credit records, such as the "red, yellow, and blue" credit rating system implemented by SF Express.

Promote privacy insurance: Platforms can insure high-risk orders (such as contraceptive products), with insurance companies providing compensation first in case of leaks.

3. Enhanced Consumer Education

Privacy settings self-check: Provide an in-app entry point for "Privacy Protection Level" queries and prompt users to disable permissions such as "Allow third parties to read order information."

Emergency response training: In collaboration with the Women's Federation and the 12355 hotline, we offer "anti-harassment self-rescue courses" that teach users how to deter harassers through methods such as "audio recording for evidence collection" and "virtual police reporting."

Conclusion: Moving from “Passive Rights Protection” to “Proactive Defense”

The Chengdu case exposes not only the moral failing of a single delivery worker but also the broader shortcomings in privacy governance across the entire online shopping ecosystem. Consumers must remember: in the face of harassment, silence is not golden—evidence is your shield. From saving every harassing text message to pressing platforms on their technical vulnerabilities, every insistence on accountability drives the evolution of industry rules. Only when law, technology, and civic awareness converge can the “last 100 meters” of online shopping truly become a safe zone.