Introduction:The Shanghai Cyberspace Administration recently conducted a follow-up inspection and found that six well-known chain coffee brands—including Luckin, M Stand, Costa, Pacific, Nowwa, and Yichi Huayuan—have still not effectively implemented the Personal Information Protection Law. They continue to engage in unauthorized collection of consumers’ personal data and have therefore been summoned for talks once again. This article will delve into the background of the incident, common violations, and how consumers can protect their privacy when using mini-programs to place orders.
Recently, the Shanghai Cyberspace Administration carried out a follow-up inspection of chain coffee brands that had previously received legal education training. The results showed that six companies—Luckin, M Stand, Costa, Pacific, Nowwa, and Yichi Huayuan—still failed to properly comply with the relevant provisions of the Personal Information Protection Law, continuing to collect customers’ personal information unlawfully, and were thus summoned for a second round of talks.
This is not the first privacy compliance action targeting the coffee industry. As early as May this year, relevant Shanghai authorities provided legal education and compliance guidance to 24 chain brands, including Starbucks and Luckin. The focus was on explaining common personal data violations in coffee consumption scenarios and requiring businesses to conduct self-inspections and rectifications. However, nearly three months later, some companies still show no signs of improvement.
Practical tests have found that when consumers choose to refuse to provide permissions such as precise location, some brands’ mini-programs cannot even function properly for ordering, forcing users to place orders manually through store staff, which significantly reduces convenience.This kind of design is often regarded as “forced authorization” and already violates the spirit of the personal data law.
The main issues identified with the six brands summoned this time include: incomplete, inaccurate, or unclear privacy policy content; excessive or frequent requests for users to provide precise location data; mandatory or inducive membership sign-ups; and failure to provide simple ways to disable targeted push notifications. These practices may inadvertently lead to the leakage of consumers’ sensitive information such as contact details and consumption habits, and may even result in unwanted harassment calls.
It is worth noting that the privacy terms of many ordering platforms are overly lengthy and filled with technical jargon, making it difficult for the average consumer to quickly understand the actual scope of data collection, thereby forcing them to agree to authorization.All just to successfully place an order for a cup of coffee.
The Cyberspace Administration pointed out that although many companies have set up membership systems and personal data protection policies, they rarely offer alternative options—such as a simplified process where payment can be completed simply by scanning a payment code. Industry insiders suggest that in addition to strengthening regulatory compliance, brands should also focus on the consumer experience by providing more flexible privacy choices and payment methods.
In the future, the Shanghai Cyberspace Administration will continue to carry out “follow-up inspections” on-site, and for companies that repeatedly violate regulations and refuse to rectify, they will initiate legal investigations, impose penalties, and publicly expose them. Members of the public who discover suspicious personal data leaks or excessive collection behaviors can also report them through official channels and provide relevant clues to assist in the investigation.
As consumers, while enjoying the convenience of digital ordering, we should also stay vigilant, carefully authorize our personal information, and periodically review the service terms we use, in order to safeguard our personal privacy and security.
The above content is compiled by CoffeeHunters, a coffee news website.
