Kakao Corp.

• Score 2019

Kakao disclosed substantially more than its South Korean peer Samsung about policies affecting users’ privacy and security, but disclosed less than all of the U.S.-based internet and mobile ecosystem companies. Kakao’s privacy policies were easy to find and understand, and disclosed a commitment to notify users of changes to these policies, though it was not always clear how users would be notified (P1, P2). Kakao clearly disclosed what types of user information it collects (P3) and disclosed the most about what user information it shares and with whom (P4). However, it was less transparent about its purposes for collecting and sharing user information (P5), and failed to disclose a time frame for deleting information when users terminate their accounts (P6). It provided users with some options to control the company’s collection of their information and the right to opt out of targeted advertising (P7). It disclosed nothing about whether or how it tracks users across the internet (P9).

Kakao disclosed less about how it handles government and private requests for user information than all U.S. internet and mobile ecosystem companies evaluated, but more than the rest of its peers (P10, P11). It provided no information about whether it notifies users of government or private requests for user information (P12). Kakao offered more disclosure than Facebook and its South Korean counterpart Samsung about its security policies (P13-P18). It was the only company to fully disclose the internal measures it takes to secure users’ information, including conducting security audits and limiting and monitoring employee access to user data (P13). It improved its transparency about how it addresses data breaches (P15). However, it provided insufficient information about measures taken to address security vulnerabilities (P14) and its encryption practices across different services (P16).