top of page

Do social media accounts need to link VNeID before December 31?

Oct 15
5 min read

Decree 320/2026/ND-CP requires many electronic transaction accounts on digital platforms to be linked and verified with VNeID. For accounts within the applicable scope that were created before September 28, 2026, the main deadline is December 31, 2026, while banking accounts have until June 30, 2027. However, this should not be interpreted as meaning that every personal Facebook, TikTok or social media account must independently link to VNeID before year-end.

Information claiming that “social media accounts must be linked to VNeID before December 31” has attracted significant attention, especially as Facebook, TikTok and other digital platforms have become deeply embedded in everyday life and business activities.

Most accounts falling within the scope of the regulation and created before the decree took effect must complete the process by December 31, 2026. Banking accounts have a later deadline of June 30, 2027.

However, interpreting this as “every Facebook or TikTok user must personally link their account to VNeID before December 31” is not fully accurate.

Which accounts are covered by Decree 320/2026?

Decree 320/2026/ND-CP amends and supplements several provisions of Decree 69/2024 on electronic identification and authentication.

According to VnExpress and Thanh Nien, the new rules add requirements for electronic transaction accounts on digital platforms to be linked and verified with a VNeID electronic identity account.

For accounts created before the decree took effect on September 28, 2026, the following transition deadlines apply:

Sector

Deadline for applicable accounts created before September 28, 2026

Education

December 31, 2026

Digital literacy initiatives

December 31, 2026

Securities

December 31, 2026

Telecommunications

December 31, 2026

E-commerce

December 31, 2026

Electronic invoicing

December 31, 2026

Transport business

December 31, 2026

Tourism

December 31, 2026

Pharmaceuticals

December 31, 2026

Medical examination and treatment

December 31, 2026

Social media in Vietnam

December 31, 2026

Banking

June 30, 2027

For e-commerce, the scope specifically includes accounts belonging to sellers, livestream sellers and affiliate marketers, in accordance with e-commerce regulations.

Banking is given a longer transition period, with a deadline of June 30, 2027.

Electronic transaction accounts used for national defense, security and certain cross-border services may also need to be linked and verified before use once the relevant platform meets the required conditions and connects to the electronic identification and authentication system.

Do all Facebook and TikTok accounts need to link to VNeID before December 31?

The regulation should not be interpreted that way. The source of confusion is the use of the term “social media.”

The decree refers to “electronic transaction accounts” on digital platforms rather than simply stating that every Facebook, TikTok or personal social media account must independently connect to VNeID.

As a result, simply having a social media account does not automatically mean that a user must immediately perform a VNeID linking process before December 31, 2026.

The requirement first applies to platforms and systems that provide accounts falling within the scope of the regulation.

What users will need to do, which specific account types will require verification and how the process will work will depend on how each platform implements its connection to the electronic identification system.

Instead of assuming that “Facebook must be linked to VNeID before December 31,” users should follow:

  • guidance from relevant authorities;

  • official notices from the platform they use;

  • verification procedures provided directly inside official apps or websites;

  • clarification on which specific accounts fall within the regulation.

Why is the term “electronic transaction account” easy to misunderstand?

In everyday language, users often refer to Facebook, TikTok, banking, e-commerce and securities accounts simply as “online accounts.”

Legally, however, the scope can be much more specific.

The sources indicate that Decree 320 refers to electronic transaction accounts on digital platforms. Therefore, seeing the term “social media” in the list of sectors is not enough to conclude that every personal social media account is automatically subject to the linking requirement.

The distinction can be understood as follows:

  • Personal social media account is a common everyday term used by users.

  • By contrast, an electronic transaction account is a concept used within the legal framework governing electronic transactions and is tied to specific users, activities and authentication mechanisms.

This is also why news headlines may say “social media accounts must link to VNeID,” while the actual scope needs to be understood from the full regulatory context.

What should businesses and users prepare before December 31, 2026?

For users, the most important point is not to complete any verification process through unknown links simply because a message says “you must link VNeID before December 31.”

User checklist

  • Follow notices from official apps or websites.

  • Do not provide passwords, OTP codes or identity information through suspicious messages.

  • Do not install VNeID through APK files or unofficial sources.

  • Check the website domain before completing any authentication step.

  • Do not pay any “VNeID verification fee.”

  • If you are unsure whether your account is affected, wait for guidance from the platform or competent authority.

For businesses operating digital platforms or account systems that fall within the scope of the regulation, the requirements are more complex.

Businesses should review

  • the types of user accounts they provide;

  • their current identification and authentication mechanisms;

  • their ability to connect with the electronic identification and authentication system;

  • how identity data is processed;

  • which employees and systems have access to user identity data;

  • communications plans to prevent customers from being misled by fake verification notices.

Businesses can refer to IPSIP Vietnam’s guidance on Identity and Access Management – IAM to better understand the role of identity, authentication and access control in enterprise systems.

What does VNeID linking mean for digital identity management?

At its core, linking accounts with VNeID is intended to provide more consistent identification and authentication in digital transactions.

This is particularly relevant to sectors with large numbers of users and transactions, such as banking, securities, telecommunications and e-commerce.

However, stronger identity verification does not automatically eliminate every cybersecurity risk.

An identified account can still be compromised if:

  • login credentials are stolen;

  • the user’s device is taken over;

  • the user gives an OTP code to an impersonator;

  • an authenticated session is abused;

  • the platform manages access rights poorly.

VNeID should therefore be understood as one component of broader digital identity management, rather than a complete replacement for passwords, MFA, login monitoring and access control.

For businesses, the key issue is not only whether VNeID has been integrated, but also how identity data is handled after authentication and who is allowed to access it.

What does IPSIP Vietnam’s cybersecurity perspective suggest?

The new requirement to link and authenticate electronic transaction accounts with VNeID represents a significant expansion of Vietnam’s digital identity framework.

However, the key is to understand the scope correctly: the December 31, 2026 deadline does not automatically mean that every social media user must personally connect a Facebook or TikTok account to VNeID.

ipsip-viet-nam-cybersecurity-solutions
IPSIP Vietnam cybersecurity solutions
During the transition period, users should rely on official instructions rather than information circulating online. For businesses, this is an appropriate time to review identification, authentication, access management and customer communication processes so that compliance does not create new opportunities for phishing or impersonation.

References

follow ipsip vietnam.png
40051abd5a76713af8f015988fc6780e-blue-phone-icon-with-a-wave-on-it.webp
Logo-Zalo-Arc.webp
pngtree-minimal-calendar-icon-vector-png-image_21233134.png
bottom of page