Digital platforms

Tencent Holdings Limited

Rank: 13th
Score: 25%

Headquartered in China, Tencent offers social media, messaging, gaming, music, and cloud services. Tencent’s multi-purpose messaging platform, WeChat, dominates the Chinese market, with 1.25 billion[1] monthly active accounts held by government entities, businesses, media outlets, and individuals. Tencent’s revenues are driven by a combination of online gaming sales, advertising, and financial services.

Yahoo2
54%
Google4
47%
Meta5
46%
Apple6
44%
Kakao6
44%
Yandex8
35%
Baidu9
28%
VK9
28%
Alibaba11
26%
Samsung11
26%
Amazon13
25%
Tencent13
25%

Tencent came in at the bottom of our ranking this year, tying with Amazon for last place, despite gaining nearly three points since our last ranking. As China’s largest tech company by market capitalization, Tencent faced heavy scrutiny from regulators amidst the country’s recent regulatory crackdown on the tech sector that targeted issues ranging from antitrust to data protection.

With the implementation of China’s Personal Information Protection Law (PIPL), Tencent published a raft of disclosures describing its governance procedures related to privacy protection and stated that the company follows the principle of data minimization when collecting users’ data. Tencent nevertheless was ordered to undergo a privacy inspection before updating its apps last November, after regulators found that its services (including WeChat, news, music streaming, and other apps) were collecting users’ information “excessively.” Although Tencent stated that it limits employees’ access to user information, public allegations that an executive shared WeChat user data without authorization raised concerns about the effectiveness of Tencent’s data protection mechanisms. We found no evidence that WeChat users were protected by advanced encryption protocols such as unique key or end-to-end encryption.

As ever, censorship also remained a significant problem for WeChat users. Following instructions from the Cyberspace Administration of China, WeChat and other major social media platforms removed a number of accounts that “released financial news illegally, distorted economic policy interpretations, badmouthed financial markets, spread rumors and disrupted network communications.” These are also known as financial “self-media” accounts in China. As usual, the company published no data about the content it restricted.

Key takeaways

  • For the first time, Tencent stated that before launching new products, it conducts risk assessments on their privacy-related impacts, though it made no mention of using a human rights framework to do so. The company provided no evidence that it conducts risk assessments in other areas, such as content rule enforcement or algorithmic-systems use.
  • As in years past, Tencent published no information about how it handles government requests for censorship or user information. This was unsurprising, as China’s political and legal environment discourages companies from doing so.
  • Although China launched a new regulation on algorithmic recommendation, Tencent published incomplete information about its development and deployment of algorithmic systems.

Key recommendations

  • Conduct human rights due diligence. Tencent should also conduct risk assessments on new and existing services and when entering new markets.
  • Publish data on content rule enforcement. Tencent should publish data about the volume of content it restricts for violating company rules, to complement the data it publishes about account restrictions.
  • Give users more control over their information. Tencent should provide users with more options to access and control their own information.
  • Be transparent about algorithmic system deployment and development. Tencent should publish policies explaining how it develops and uses algorithmic systems and provide users with more options to control these systems.

Services evaluated:

  • QZone
  • QQ
  • WeChat
  • Tencent Cloud

The 2022 Big Tech Scorecard covers policies that were active on November 1, 2021. Policies that came into effect after November 1, 2021, were not evaluated for this ranking.

Scores reflect the average score across the services we evaluated, with each service weighted equally.

  • Lead researchers: Jie Zhang, Dumitrita Holdis

Changes since 2020

  • Tencent improved some privacy-related governance processes: it set up a personal information protection team, offered employee training on privacy protection, provided a channel for users to file complaints regarding privacy issues, and disclosed some risk assessments on privacy issues for the first time.
  • The company stopped disclosing details about how it infers user information.
  • Tencent announced that it has an internal team that conducts security audits and that it also commissioned third-party security audits.
  • Tencent published a revised company-wide Privacy Policy that revealed less information regarding the collection, inference, and sharing of user data than previous versions did. In contrast, Tencent Cloud published new stand-alone Privacy Protection Guidelines offering clear details about its user information collection process.

Scores since 2017

100%0%2017201820192020202222%23%26%22%25%
Most companies’ scores dropped between 2019 and 2020 with the inclusion of our new indicators on targeted advertising and algorithmic systems. To learn more, please visit our Methodology development archive.
Governance13%
Freedom of expression15%
Privacy36%

We rank companies on their governance, and on their policies and practices affecting freedom of expression and privacy.

Governance 13%

Tencent made the third-largest improvement in the governance category, due to a series of new privacy protection measures. But overall, the company still published less information about its policies and practices than all other digital platforms ranked, except for Alibaba. And its public disclosures only addressed privacy issues. As in the past, the company made no commitment to protect users’ rights to freedom of expression (G1). In addition, Tencent offered almost no evidence that it conducts human rights risk assessments (G4).

Freedom of expression 15%

Tencent shared only slightly more information about policies and practices affecting users’ freedom of expression than Baidu, which took last place in the category. Although advertising revenue is important for Tencent, the company does not offer a comprehensive policy describing how users are targeted and how the system works (F1c, F3c). Other than some generalized information about the number of accounts it restricted, Tencent failed to release any data regarding content or advertisements banned for violating company rules (F4a, F4b, F4c). Like its Chinese peers, Tencent was silent about censorship requests from the government (F5a, F6).

Privacy 36%

Tencent’s privacy policies disclosed more about how its services collect user information (P3a) than any other company apart from Baidu. These policies still offer insufficient details about how the company infers user information (P3b). Tencent said little about how long it retains user information (P6) and offered insufficient means for users to access, manage, or control their own data (P7, P8). Tencent published no information about how it handles government requests for user information (P10a, P10b).

Footnotes

[1] This figure combines users of the domestic and international versions of the tool. Tencent did not publish the volume of the monthly active users for each version separately.