There is a widespread distrust in high tech companies around the world since the scandal of the Cambridge Analytic information of Bookface broke out. A user agreement for ZAO, a Chinese-made app for changing human face images in videos became a hot issue on the internet the other day because of its provision that no person can use the app without giving the right to use their face images permanently. Many people thought that the app developer Changsha SHEER Network Technology Inc. (“ZAO Company”) infringed the user’s portrait right and privacy.   

I have summarized four frequently asked questions.

Question 1: Can ZAO Company use user uploaded portraits at its own discretion?

Question 2: Can ZAO Company have the right to a user’s portrait uploaded by other person?

Question 3: Will users have to pay astronomical damages for uploading a video containing a celebrity’s portrait? 

Question 4: As ZAO Company has portraits of its users and requires user authentication by cellphone, will users paying by face scanning take the fraud risk? 

I am lawyer of many internet businesses, not including the ZAO app developer Changsha SHEER Network Technology Inc. and its possible affiliate Momo Company. My opinions on this case are only based on my personal experience. 

Question 1: Can ZAO Company use user uploaded portraits at its own discretion?

The most disputed sentence in the User Agreement of ZAO Company is that:

Changing a human face image in user contents to your own or other person’s face image means you have agreed or caused the portrait owner to agree to grant ZAO and its affiliates a worldwide, totally free, irrevocable, permanent, assignable and sublicensable license for your or the portrait owner’s protrait right in materials including not limited to photos, pictures and visual materials, and to change your or the portrait owner’s portrait by using technology. 

Is such an arbitrary clause valid? As a lawyer I think it depends on how the court will decide its validity if an action is taken. Let me tell you two extreme cases. One is ZAO Company using user uploaded portrait to made a willfully falsified video; the other is ZAO Company making an ad for an advertiser by using portraits of its users without their permission.  

These are typical cases of infringing user’s legal interests by misusing template clauses. Pursuant to Article 40 of the Contract Law, if a person uses a template clause to exempt its liabilities and impose more obligations on and exclude major rights of the other party, the clause is invalid even if there is a user agreement and the court will decide based on this that the clause is invalid. 

Why ZAO Company included the clause that cannot be accepted as valid by the court? Perhaps because ZAO Company is protective towards itself. The biggest enemy of a startup in China is usually its “business friends”, i.e. businesses in the same industry. As the size of the market is constant, if you beat your business friends, you will dominate the market quickly. Plagiarism and scrabbles for data and contents of popular projects or apps are very common in the Chinese internet industry. For example, some competitors of ZAO made a large number of copies of videos on ZAO apps and published them on their own websites. If ZAO Company  sued them based on this clause, the court will most likely to find it valid. For this reason ZAO Company stated in the user agreement that:       

“ZAO and its affiliate will use their best efforts to use the said contents to a reasonable extent and your grant of a necessary license does not mean ZAO and its affiliates will definitely use the said contents and will not change the owner of the contents and intellectual property rights therein or otherwise affect your legal use thereof”.

Many people describes the user agreement stipulated by ZAO Company as arbitrary without reading the above provision.

Question 2: Will users have to pay damages for uploading a video containing other person’s or a celebrity’s portrait?

Some people said that if ZAO app was sued by a celebrity for containing an unauthorized video, the responsible platform would pursue the user’s responsibility. I don’t agree with them. If the celebrity claims for a non-licensed ZAO app, the platform should definitely be responsible for it. However, if the platform sues the user for it, the court will turn down its claim because the platform should be responsible for the legality of licenses for its own materials and in no event should users be responsible for it.

Even if ZAO app allows its users to upload their video, in most cases ZAO will be held responsible for user’s act of uploading others’ portraits without due authorization.  

As stated above, as the user agreement is invalid, ZAO company cannot obtain the user’s right in their portrait uploaded and included in a video without due authorization, whether the user is a celebrity or an ordinary person. If a video made by ZAO app using an unauthorized portrait becomes popular, ZAO company could be sued for lax censorship, in which case the court could decide that as a platform ZAO should be responsible for being accessory to the infringement.      

Why platforms should take most responsibility for infringement caused by videos made and uploaded by their users? Based on my practical experience for years, it is generally accepted in the industry that if a platform doesn’t protect its user’s privacy, they will not use its services. If people published contents on a platform, for example, sina weibo, ZH, that infringe other person’s civil rights such as copyright, trademark right, privacy and reputation right and the infringed person issues a lawyer letter demanding sina weibo, ZH remove the infringing contents and disclose the infringing person’s information, the platform involved can do nothing but remove related information, usually without disclosing the infringing person’s registered information to the complainant. Then the complainant has to sue the platform to require disclosure. The platform won’t disclose any information until receiving the court’s decision. Information disclosed could only be a cellphone number or an IP address on the platform. It is difficult for ordinary people to find out who published the infringing contents according to such information.

If users of ZAO uploads a video containing an unauthorized portrait of a third party, it is most advisable for the infringed person to sue ZAO company for its unauthorized use of the portrait rights in order to receive damages. If the video is a hit, the court will decide that the platform should pay damages, apologize and take other responsibility for its failure to check the source of the portrait rights with due care. A persistent right owner may find the identity of the person who published the infringing contents. 

Question 3: What are the consequences of ZAO company divulging its users’ information, causing the user’s money to be stolen by other person using the user’s face image?  

With the advent of the face recognition technology disclosure of a person’s face image can cause very serious economic losses. Most criticisms against ZAO app arise from its users’ suspicion of its data protection ability. 

Some people said that users can login ZAO app with their wechat accounts but are still required to provide their cellphone numbers and face details. Others said that important private information such as face details should not be given in this way that makes it possible for dishonest equipment dealers to store it and let a large amount of face details into the black market, unless required by the national government for security purposes”. What they said involves important legal issues including real-name registration and data protection related rules.    

Subject to the Cybersecurity Law, ZAO company is obligated to require users provide real identity information. To implement the real-name registration system internet companies usually requires cellphone certification, which is approved by the government. Login with a wechat account does not violate the real-name registration system because registration for a new wechat account requires a cellphone number. Then why ZAO company needs its users’ cellphone numbers? As far as I know, most internet companies require new users register with their cellphone numbers and allow them to login with their wechat accounts for their convenience. 

One of the possible reasons is that third parties can be allowed or not allowed to use wechat, a service developed by Tencent company. For example, wechat refused to provide login services to Douyin users during the recent “battle between Toutiao and Tencent”. Another reason is that internet companies can obtain more personal information if they have their users’ cellphone numbers so that they can send commercial ads to them.     

Personal portraits are biological recognition information with very high sensitivity. 

ZAO company is taking a big risk requiring users provide their cellphone numbers without having the ability to fully protect users’ information. Malicious use of portraits and cellphone numbers that are linked together by big data is a very serious outcome of privacy revelations. Therefore, for compliance purpose ZAO company has to meet legal, technical and hardware requirements about data storage. Laws and rules including the Cybersecurity Law, the Regulations of Protecting Personal Information of Telecommunication and Internet Users and the Regulations of Classified Protection for Information Security specify data collection, storage, use and liability provisions. ZAO company needs to improve its user personal information protection system according to these provisions.

If ZAO company does not meet the compliance requirements, resulting in an information revelation, for example, a theft of non-desensitized information, the company and the directly responsible person will face a serious legal punishment and if infringing user’s civil rights, pay compensation to them.     

Article 29 of the Consumer Protection Law states that businesses should take technical and other necessary measures to ensure information security and prevent the revelation and loss of personal information of consumers and take immediate action to remedy any actual or possible information revelation or loss. There are related administrative punishment rules made by the Ministry of Industry and Communication and the Ministry of Public Security. ZAO company could face administrative penalty if it causes a revelation of personal information of its users.  

In aggravated cases of personal information revelation ZAO company could face criminal penalty. Article 286 of the Criminal Law states that online service providers who do not fulfill their duty of administering information and network security under relevant laws and administrative rules and do not take corrective action as required by the regulatory department, causing user information revelation with serious outcome should be sentenced to less than three years’ imprisonment, detainment or regulation and/or pay a penalty.    

There is no need for alarm among users who have uploaded information by ZAO app. In case of information revelation, is not very likely, if not impossible, to steal money by scanning a face image. Platforms like unionpay, alipay and wechat take preventive technical measures.  

In this case not all criticisms from the public are reasonable but ZAO company did not have a complete set of data protection rules and were thoughtless about its problems. Portrait rights contain personal attributes with high sensitivity. ZAO company’s “unfair clauses” relating to such rights are actually easy to upset users and need to be reconsidered.