Kakao Corp.
Key findings
- Kakao disclosed more about policies affecting freedom of expression and privacy than many of its peers, but still fell short in key areas.
- The company disclosed more than some U.S. companies, including Apple, about policies affecting freedom of expression.
- Kakao disclosed little about its handling of security vulnerabilities and how it addresses data breaches.
Analysis
Kakao ranked sixth out of the 12 internet and mobile ecosystem companies evaluated, and failed to disclose sufficient information about policies and practices affecting freedom of expression and privacy. However, the company performed better than many companies in the Index, including Apple, and continued to outperform Samsung, the other South Korean internet and mobile ecosystem company evaluated, by roughly 21 points. Notably, South Korean law, such as requirements for grievance mechanisms, helped to boost the company’s performance. However, regulatory factors prevented disclosure in other areas. For example, laws requiring companies to remove copyrighted and defamatory content make it difficult to disclose information about certain types of lawful requests to remove or restrict content. Kakao would benefit from a clearer explanation to users about how the law affects what it does not disclose.
- Be more transparent about policing of content. The company should disclose data about the volume and nature of content or accounts it restricts for terms of service violations.
- Be more transparent about handling of user information. Kakao should improve its disclosure of whether and how it collects data by tracking users across the internet.
- Communicate more clearly about security. The company should disclose more about its security policies and practices, including its policies for responding to data breaches.
Kakao Corp. provides online communication and search services in South Korea and internationally, with products that include web-based mail and messaging, a search engine, and maps and location services.
Governance
Kakao ranked sixth out of the 12 internet and mobile ecosystem companies in the Governance category, below five U.S.-based companies, but scored higher than Apple. It disclosed a commitment to engage with stakeholders (G5) and more about its grievance and remedy processes (G6) than any other internet and mobile ecosystem company evaluated. While this is largely due to requirements under South Korean law, Kakao went beyond the legal requirements by providing users with an appeals mechanism for when content is removed in response to defamation claims. However, the company disclosed little regarding its implementation of human rights impact assessments on potential risks to freedom of expression and privacy (G4).
Freedom of expression
Kakao received the third-highest freedom of expression score among internet and mobile ecosystem companies, behind Twitter and Google.
Content and account restrictions: Kakao led most of its peers in its clarity about what types of content and activities are prohibited across its services (F3, F4, F8). However, while Kakao disclosed more than most of its peers, on par with Microsoft, about what its rules are and its processes for enforcing them (F3), it disclosed no data about the volume or type of content removed or accounts deactivated as a result of terms of service violations (F4). The company earned the second-highest score after Twitter for its clear policies about notifying users when it removes content or restricts accounts (F8).
Content and account restriction requests: Kakao disclosed less than Google, Oath, Twitter, and Facebook about its handling of government and private requests to remove content or restrict accounts, but it provided more information than Microsoft and Apple (F5-F7). Disclosure of its processes for responding to government and private requests (F5) was slightly above average, although disclosure of government requests was weaker than about private requests. Notably, the company did not provide data about government requests to restrict content or accounts from outside of South Korea (F6). Kakao disclosed more data than its peers, except for Twitter, about private requests it receives to block content or restrict user accounts (F7).
Identity policy: Kakao stated it may require users to verify their identities with their phone number or an official ID in order to access some services (F11).
Privacy
Kakao received the sixth-best privacy score of the 12 internet and mobile ecosystem companies evaluated, falling behind five U.S.-headquartered companies, but scoring higher than Facebook.
Handling of user information: Kakao disclosed less than most U.S. companies but more than Facebook about its handling of user information (P3-P9). Notably, Kakao received the highest score of any company in the Index for its disclosure of what types of user information it collects and shares (P3, P4), but was less transparent about its purpose for doing so (P5). While the company improved its disclosure of options KakaoTalk users have to control how their user information is used for targeted advertising, this suggested that targeted advertising is on by fault (P7). Kakao also disclosed nothing about whether it tracks users across the internet (P9).
Requests for user information: Kakao disclosed less about how it handles government and private requests for user information than all U.S. internet and mobile ecosystem companies evaluated, but more than the rest of its peers (P10, P11). It provided no information about whether it notifies users of government or private requests for their information (P12).
Security: Kakao ranked in the top half of internet and mobile ecosystem companies on its disclosure of its security policies, though it offered less disclosure than Google, Apple, Yandex, and Microsoft (P13-P18). It received full credit, along with Google, for disclosing what internal measures it takes to secure users’ information (P13). However, it provided little information about measures taken to address security vulnerabilities (P14) or about its handling of data breaches (P15). Kakao also disclosed less than most of its peers about its encryption practices across different services (P16).
P7. Users’ control over their own user information
The company improved its disclosure regarding the options KakaoTalk users have to opt out of targeted advertising. although this suggests that targeted advertising is on by default.
