MANILA, Philippines — The National Privacy Commission (NPC) has issued show-cause orders against tech giants Meta, Roblox, Reddit, and Discord for allegedly failing to meet mandatory registration requirements under Philippine data privacy regulations.
The regulatory action, announced on Tuesday, September 22, stems from compliance obligations outlined in the Data Privacy Act of 2012 and NPC Circular 16-03. The directives require all four digital platforms to formally account for their non-compliance as part of an expanding probe into online services handling personal data from users across the Philippines.
The NPC will review whether these digital platforms strictly follow rules regarding registration, operational transparency, lawful data processing, data subject rights, corporate accountability, and technical security measures.
The investigation specifically prioritizes services used by children and youth, whose data is collected during gaming, educational, and social interactions.
“It is NPC’s position that the safety, privacy, and overall well-being of our youth must always come first. As learning and social interaction increasingly take place across both physical campuses and digital spaces, we are dedicated to protecting the privacy and data subject rights of our youth and promoting responsible data processing,” the commission stated.
The NPC’s intervention coincides with a separate 24-hour ultimatum sent by the Cybercrime Investigation and Coordinating Center (CICC) instructing Reddit and Discord to appoint a designated resident agent or local representative.
Sent in letters dated September 21, the CICC warned that non-compliance could lead to operational restrictions or access blocks within the country.
The CICC directive was triggered by the September 18 shooting incident at Banga National High School in South Cotabato, which sparked broader government worries over violent extremist content and child exploitation across online platforms.
“We are not asking platforms to police the internet for the government but to be reachable, accountable, and responsive when activities on their platforms put Filipino children and communities at risk. When an online threat spills over into the real world, there has to be clear channel for authorities to act,” said CICC Executive Director and Undersecretary Renato Paraiso.
Officials clarified that the NPC show-cause orders and the CICC directive remain separate regulatory initiatives. The privacy commission is managing compliance regarding data protection laws, while the CICC is focused on securing local jurisdiction to streamline coordination with law enforcement agencies.
While the NPC did not release a specific response deadline or detail potential penalties, it warned that non-compliant organizations will face formal regulatory sanctions.
“Protecting young people in the digital environment is a shared responsibility. Within its mandate, the NPC will continue to ensure that organizations processing personal data are held accountable and that the rights guaranteed to data subjects under Philippine data protection law are respected,” the agency concluded.