TOKYO -- The voice chat app Clubhouse has been thrust into the spotlight in recent weeks as a unique new form of social media, attracting wide range of fans from Chinese dissidents to Elon Musk.
But as its user base swells into the millions, authorities and experts have sounded alarm bells about its operator's opaque privacy practices.
The audio-only platform, launched last year by U.S.-based developer Alpha Exploration, lets users join themed chat rooms to listen to and interact with speakers -- much like a call-in radio show or panel discussion -- or for free-for-all talks.
It has become a trendy hangout for celebrities, and it saw a surge in popularity, including in Asia, after Tesla founder Musk's recent debut on the platform. Just weeks after its January launch in Japan, young politicians have begun using it to communicate with constituents.
The app gained a sizable following in China, with many using the platform to talk about sensitive subjects like Hong Kong, the Tiananmen Square crackdown and human rights concerns in Xinjiang outside the grip of Beijing's ubiquitous censors. But the government soon clamped down, and Clubhouse was apparently blocked in mainland China this month.
Now regulators in Europe are raising other concerns.
In a statement this month, data protection authorities in the German city of Hamburg warned the app "raises many questions about the privacy of users and third parties." Of particular concern, they said, is the fact that "operators also store the recordings of all conversations held in the various rooms of the app in order to track abuses without the closer circumstances becoming transparent."
Few users are aware that their conversations are recorded. The platform's terms ban users from doing so themselves without express written consent from everyone involved, and its apparent ephemerality -- in contrast to the permanence of platforms like Facebook and Twitter -- is part of its appeal.
But some aspects of this process are unclear, such as the standards for determining what comments would trigger an investigation, and there is no way to confirm whether recordings have actually been deleted.
Multiple lawyers with expertise in data privacy issues say that keeping recordings could be illegal in Europe without a better explanation and clearer consent from users.
"That doesn't seem to be enough" to comply with GDPR, a Europe-based attorney said.
The Hamburg authorities also voiced concern about Clubhouse's handling of contact information from users' phones.
"One of the principles of the GDPR is collecting the minimum amount of data necessary," said Takeshige Sugimoto, a partner at law firm S&K Brussels and an expert on data law. Clubhouse's collection of data from nonusers could violate this principle, depending on how the data is used.
"Contact data of numerous people, without them even coming into contact with the app, ends up in foreign hands" -- namely the app's American operator -- without complying with European protection requirements, the Hamburg authorities said.
It is also possible that information gathered by Clubhouse could be passed on to third parties without users' knowledge.
The app has access to a variety of data on its users, including topics they are interested in and people they interact with. And the company's explanation of the purposes it uses this information for "is abstract and can be interpreted broadly," Sugimoto said.
Such privacy issues have cropped up with other social media companies, most notably Facebook, which has been heavily criticized for collecting detailed personal data about users without their knowledge and using it for microtargeted advertising as well as sharing it with partners. Yet other platforms have improved on this front in recent years.
"Clubhouse has classic problems with personal data protections," said Japan-based attorney Ryoji Mori.
Nikkei sent a list of questions by email to Clubhouse about its recording policies and protections for personal data, but had not received a response as of Friday.
A year after its launch, Clubhouse is still in beta. Its procedures for handling personal information have failed to keep up with its explosive growth. Users will need to proceed with caution.