Kakao Corp.

Kakao was more transparent about policies affecting users’ freedom of expression than Facebook and Apple but still failed to provide information in some key areas, including on algorithmic systems.

• Content moderation: Kakao provided less information about how it enforces its terms of service through content or account restrictions than most of its digital platform peers, except Amazon (F3a). At the same time, Kakao published more comprehensive data about content and account restrictions in its transparency reports than any other digital platform except Twitter, and it made the data available for download (F4a, F4b).

• Algorithmic use andcontent curation:Kakao failed to publish operational policies that govern the use or development of its algorithmic systems (F1d, P1b). The company disclosed nothing about how it uses algorithms for content curation or recommendations in Daum Search, its search engine (F12). On the positive side, Kakao’s terms of service for developers offered rules to regulate the use of bots on its platform (F13).

• Advertising content and targeting: Kakao revealed little about how it regulated its advertisements. Its ad content policies only listed what types of ad content is prohibited, but failed to further explain how the company enforces its policies (F3b). Kakao stated that it does not allow advertisers to target children under 14, but offered no other information about types of ad targeting that it might prohibit (F3c). It also published no data on the number of ads it restricted (F4c).

• Censorship demands: Kakao disclosed more about its process of handling private requests to restrict content or accounts than any other company we evaluated (F5b). It also increased its transparency about how it responds to demands from governments seeking to censor content or restrict accounts (F5a). In addition, Kakao made the data for those requests available for download (F6, F7).

Kakao stood out for strong security policies but disclosed insufficient information about how users can access and control their own information.

• Handling of user data:Kakao clearly disclosed policies on how it collects and shares user information (P3a, P4), but offered little detail on its purpose for collecting and sharing this information (P5). It provided more information than any other digital platform about what types of user information it shares (P4), but disclosed nothing about what user information it inferred (P3b) or how it collected information from third parties (P9). In addition, Kakao did not share whether or how it de-identified user information (P6). Although it gave users some control over their information, allowing them to block targeted advertising (P7) and to obtain some of the data the company held about them (P8), users’ overall access to and control over their own information was limited.

• Government and private demands for user data:Kakao’s privacy transparency report described how the company handled government demands for user information, and gave some information about when it would not notify users of these demands (P10a, P11a, P12). Yet, like most companies, Kakao mentioned nothing about how it handles responding to private requests (P10b, P11b).

• Security:Though it trailed Apple, Microsoft, and Baidu, Kakao disclosed more about its security policies than most digital platforms. The company disclosed information about its internal data security protocols (P13) and outlined ways users can keep their accounts secure (P17). Kakao lacked transparency about its security vulnerability reporting system (P14) and how it addresses data breaches (P15).

• Encryption: Kakao’s transparency about its encryption protocols deteriorated, as KakaoTalk removed a statement ensuring that it encrypts the transmission of users’ communication (P16).