BIR Suspends Mandatory Online Seal Badge

The Bureau of Internal Revenue (BIR) suspended the mandatory online display of its Registration Seal Badge on Monday, lifting the October 31 compliance deadline until further notice and conceding that the requirement had raised problems it had not resolved. Commissioner Charlito Martin Mendoza formalized the pause in Revenue Memorandum Circular (RMC) No. 113-2026, which suspends the display rule first set out in RMC No. 38-2026 last April and later supplemented by RMC Nos. 64-2026 and 99-202613. The badge is an electronic copy of a taxpayer's BIR Certificate of Registration (COR) — the document proving a business is registered with the tax agency — that covered online sellers, content creators, and service providers were to post on their websites, e-commerce pages, or social media accounts. The retreat followed complaints from those taxpayers about data privacy, technical difficulties, and uncertainty over who exactly had to comply33.

Mendoza's statement was unusually direct about the reason. "We have heard the concerns of online sellers, content creators, and other taxpayers regarding data privacy, technical issues, and the scope of the BIR Registration Seal Badge requirement," he said, adding that "protecting personal information online presents different and more complex challenges than displaying a COR at a physical business establishment"333. The circular also makes clear that taxpayers who already secured a badge may keep displaying it at their own discretion, and that "no penalties shall be imposed solely on account of non-display of the BIR Registration Seal Badge during the period of suspension"1.

The same day, the National Privacy Commission (NPC) — the government body that enforces the Data Privacy Act and advises on personal-data handling — weighed in on the specific fear driving much of the seller backlash: that a publicly posted badge, with its embedded QR code, could expose a taxpayer to identity theft. Deputy Commissioner Jose Belarmino II said on the state broadcast program Bagong Pilipinas Ngayon that identity theft and similar abuses come from a combination of a person's online activity and cannot be carried out using the QR code alone. "Iyan naman ay labas na sa usapan nitong QR code kasi one source lang iyong QR code ng information," he said — that is beyond the scope of this QR code, because the code is only one source of information8. The NPC's intervention matters because it separates two questions that had been running together in the seller complaints: whether the badge was a genuine security risk, and whether the compliance burden and the rule's unclear scope were reason enough to delay it.

The story ran across the business press and online news in the items reviewed here. Manila Standard's business section carried the suspension with the commissioner's quotes1, Philstar framed it as a response to backlash33, and Inquirer and Manila Times both led on the lifted deadline31. The Manila Times item alone carried an estimated advertising-equivalent value of about ₱273,000 — the notional cost of buying that same online space as paid advertising, not a count of readers — and the Inquirer piece about ₱228,00013. Those figures measure the coverage's space value, not its audience.

Key themes

1. The BIR lifted the October 31 deadline for its online registration badge. Revenue Memorandum Circular No. 113-2026 suspends both the compliance deadline and the mandatory posting requirement until further notice, and bars penalties for non-display during the pause13.
2. The agency cited privacy, technical problems, and unclear scope as its reasons. Commissioner Mendoza said online disclosure poses "different and more complex challenges" than posting a certificate at a physical shop, and acknowledged the concerns of sellers and content creators directly33.
3. The privacy regulator said the badge's QR code alone cannot enable identity theft. The NPC's deputy commissioner told a state broadcast that abuses stem from a combination of a person's online activity, not a single data source8.
4. Sellers and creators who already have a badge may keep it up voluntarily. The circular preserves the choice to display and removes the penalty for those who do not1.
5. The rule had already been revised twice before the pause. RMC No. 38-2026, issued April 20, 2026, was supplemented by RMC Nos. 64-2026 and 99-2026, and the deadline had earlier been moved to October 31 — a sequence that suggests the agency was adjusting the requirement repeatedly as objections mounted13.
6. The suspension drew wide business-press coverage in the items reviewed. Manila Standard, Philstar, Inquirer, and Manila Times all carried it, with the Manila Times and Inquirer online items each valued in the low hundreds of thousands of pesos in advertising-equivalent terms1333.
7. The NPC paired the badge discussion with a youth online-safety partnership. Globe Telecom renewed its memorandum of understanding with the NPC on the Kabataang Digital program, which teaches young Filipinos about data privacy and safe online behavior, and will donate a children's book on artificial intelligence and digital wellness28.

How the narratives stack

Dominant: The BIR's suspension of the seal-badge requirement is the day's lead story in this set, carried by four separate outlets across broadsheet business pages and online news1333. Its dominance rests on the number of items in the captured coverage and on the fact that it is a national tax agency reversing a compliance rule that would have touched every registered online seller and content creator in the country. The coverage is consistent on the facts — the circular number, the lifted deadline, the no-penalty clause — and consistent on the framing: a regulator responding to complaints rather than imposing a rule.

Counter-narrative: The NPC's statement complicates the privacy argument that drove the backlash. Deputy Commissioner Belarmino said the QR code is "one source lang" of information and that identity theft cannot be traced to it alone8. That does not vindicate the badge requirement — the BIR itself conceded the scope and technical problems were real — but it does undercut the strongest version of the sellers' objection. The two positions can both be true: the badge may not be a serious identity-theft vector, and the rule may still have been poorly scoped and hard to comply with.

Emerging: The Globe–NPC renewal on youth digital safety points to a broader pattern of privacy education work running alongside the badge controversy28. The Kabataang Digital program and the planned children's book on AI and digital wellness suggest the privacy regulator is building out its public-education role at the same time it is adjudicating a live dispute over taxpayer data. Whether that education push becomes a larger story depends on how visible the program becomes.

Under-covered: The mechanics of the badge requirement itself — what data the QR code actually contains, how the BIR intended to verify compliance, and what the agency will change before reissuing the rule — received little explanation in the items reviewed. The circular says the pause allows the BIR to address the concerns, but none of the coverage spells out what a revised rule would look like133. That gap matters for sellers trying to plan.

Platform insights

• Facebook: The badge controversy played out largely through Facebook statements and posts by the parties involved — the BIR's circular and the NPC's remarks were both relayed through official channels and state broadcast, and the dessert-restaurant boycott story that circulated the same day shows how quickly Facebook statements can turn into consumer campaigns1421. The platform is where Philippine small businesses and sellers organize, which is why a rule aimed at their online pages landed there first.
• X: No platform-specific engagement figures for X appear in the material reviewed. The badge story's spread in this set is documented through news coverage rather than social metrics, so any claim about how it performed on X would be unsupported.
• Reddit and YouTube: The material reviewed does not include engagement data for these platforms on the badge story. The one YouTube reference in the set is to an Aiko Melendez vlog from June that resurfaced in the Karen Davila restaurant controversy, not to the tax rule14.

Key voices and communities

Online sellers and content creators. The group the rule was aimed at, and the group whose complaints triggered the pause. Their concerns — data privacy, technical difficulty, and unclear scope — are quoted directly in the BIR's own statement, which gives them unusual standing: the regulator adopted their framing as the reason for retreating333.

The Bureau of Internal Revenue. Commissioner Mendoza's statement is the day's central document. The agency's position is that the requirement was well-intentioned but needed rework before it could be enforced, and the circular preserves the voluntary option for those already compliant1.

The National Privacy Commission. The NPC played two roles in the same day: adjudicator of the identity-theft question, through Deputy Commissioner Belarmino's broadcast remarks8, and partner in a youth digital-safety program with Globe28. Its statement that the QR code is only one information source is the most technically specific contribution to the debate in the items reviewed.

Globe Telecom and the Kabataang Digital program. Globe's renewed memorandum of understanding with the NPC extends a partnership on data-privacy education for young Filipinos, and the company will donate copies of a children's book on AI and digital wellness28. Globe chief privacy officer Irish Salandanan-Almeida framed the work around giving people "the knowledge and confidence to understand their rights, recognize risks, and make informed decisions whenever they go online"28.

Narrative streams

The BIR retreats from a rule it had already revised twice

The sequence matters. The BIR issued RMC No. 38-2026 on April 20, 2026, requiring covered online taxpayers to display electronic copies of their certificates of registration on their websites, platforms, or apps3. It then supplemented that rule twice — RMC Nos. 64-2026 and 99-2026 — and moved the compliance deadline to October 3113. Monday's circular suspends the whole apparatus. For a tax agency, that is a notable climbdown: the BIR had spent roughly six months building toward a requirement it has now shelved indefinitely.

The commissioner's language suggests the agency understood the difference between a physical storefront and an online one. A certificate of registration posted at a shop counter is visible to customers who walk in; the same document posted on a seller's Facebook page or e-commerce listing is visible to anyone, indefinitely, and can be copied and indexed. Mendoza said as much: "protecting personal information online presents different and more complex challenges than displaying a COR at a physical business establishment"33. The circular's no-penalty clause is the practical relief — sellers who did not post a badge will not be fined for the period of the suspension1.

For online sellers and creators, the immediate change is that a compliance task with a hard deadline has become optional. For the BIR, the task is now to redesign the requirement — presumably with clearer scope and better technical guidance — before reissuing it. The agency has not said when that will happen, and the circular's "until further notice" leaves the timeline open1.

The privacy regulator separates the QR code from the identity-theft fear

The most specific claim in the day's coverage came from the NPC. Asked how sellers and creators could protect themselves from identity theft using their names, Deputy Commissioner Belarmino said the question goes beyond the QR code because the code is only one source of information8. In plain terms: a QR code on a registration badge carries a limited set of data, and identity theft typically requires assembling information from multiple sources — social media profiles, leaked databases, phishing — rather than scanning a single public code.

That distinction matters because the seller backlash conflated two risks. One is that posting a badge exposes personal information that could be misused. The other is that the rule was hard to comply with, unclear in scope, and imposed without adequate consultation. The NPC's statement addresses the first; the BIR's suspension addresses the second. Neither institution has said the other's concern was unfounded. The NPC's remarks were made on a state broadcast program, which gives them a semi-official quality — the privacy regulator was, in effect, helping the tax agency explain why the badge was less dangerous than sellers feared, even as the tax agency paused it8.

For the sector, the read is that privacy objections to public-facing compliance requirements will now be tested against technical evidence rather than accepted at face value. Sellers who argued the badge was a security hazard have been told, by the government's own privacy authority, that the hazard was overstated. That weakens the privacy argument as a template for resisting future disclosure rules, even as it leaves the compliance-burden argument intact.

A second privacy story: Globe and the NPC take digital safety to schools

On the same day the NPC was explaining what a QR code cannot do, it was also extending a partnership aimed at teaching young Filipinos what to watch for online. Globe Telecom renewed its memorandum of understanding with the commission on the Kabataang Digital program, which covers data privacy, digital citizenship, and safe online behavior, and committed to donating copies of a new children's book on artificial intelligence and digital wellness28.

Globe's chief privacy officer, Irish Salandanan-Almeida, framed the partnership around capability rather than policy: "Protecting people online goes beyond having strong privacy policies and safeguards. People also need the knowledge and confidence to understand their rights, recognize risks, and make informed decisions whenever they go online"28. The program is a corporate-social-responsibility arrangement as much as a regulatory one — a telco funding education that the privacy regulator designs — and it sits alongside the badge controversy as evidence that the NPC is trying to build public awareness while it manages a live dispute over taxpayer data.

For telecommunications and digital-platform companies, the read is that privacy education is becoming a visible part of the sector's public posture, not just a compliance function. A telco that co-signs a youth digital-safety program with the privacy regulator gains standing to speak on privacy questions — including questions like the badge dispute — that it would otherwise have to answer from the outside.

The badge rule's unresolved details

What the coverage in this set does not answer is what the badge actually contains and how the BIR planned to verify it. The circular suspends the requirement and says the pause will allow the agency to address the concerns, but it does not describe a revised design133. Sellers who had begun preparing to comply — or who had already secured badges — are left with a voluntary option and no clear signal about what comes next1.

The practical consequence is that the compliance question is deferred, not resolved. A seller who posts a badge now does so at their own discretion and can remove it without penalty. A seller who does not post one faces no penalty during the suspension. The BIR has bought itself time; what it does with that time will determine whether the rule returns in a form sellers accept or triggers a second round of objections.

Conversation trajectory

Watch the BIR's next circular, expected within the next four to eight weeks. The suspension is "until further notice," which means the agency controls the timeline1. A revised rule that narrows the scope — for example, limiting the requirement to certain categories of sellers or specifying exactly what data the badge displays — would signal the BIR learned from the backlash. A reissue without changes would likely restart the same objections.

Watch the NPC for follow-up guidance on QR-code data, over the next two to four weeks. The deputy commissioner's broadcast remarks were informal8. A formal advisory specifying what information the badge's QR code contains would settle the identity-theft question with more authority than a television interview.

Watch seller and creator groups for organized response, over the next month. The backlash that produced the suspension was loud enough to move a national tax agency33. Whether those groups now push for permanent withdrawal of the requirement, or accept a revised version, will shape the next round.

Trigger events: a new BIR revenue memorandum circular on the badge; an NPC advisory on QR-code data; public statements from online-seller associations or creator groups; and any BIR announcement on when the registration verification initiative will resume.

Response guidance

Online sellers and content creators: Treat the suspension as a pause, not a repeal. The BIR has said it will address the concerns, which means a revised requirement is likely. Sellers who already have a badge can keep it up or take it down without penalty; those who do not should use the window to understand what data their registration documents expose before a new rule arrives1.

E-commerce platforms and marketplaces: Clarify for sellers what the platform itself requires versus what the tax agency requires. The confusion over scope was one of the BIR's stated reasons for pausing33, and platforms that publish plain-language guidance on registration display can reduce the next round of complaints.

Privacy and compliance teams: Separate the two arguments that were conflated in the backlash. The NPC has said the QR code alone cannot enable identity theft8; the compliance-burden argument is the stronger ground for negotiating a revised rule. Teams that lead with technical evidence will be harder to dismiss than teams that lead with fear.

Telecommunications and digital-platform companies: The Globe–NPC partnership shows that privacy education is a visible, co-branded activity28. Companies considering similar programs should expect them to be read alongside their positions on live privacy disputes, and should make sure the two are consistent.

Communicators across the digital sector: The badge story moved from announcement to revision to suspension in about six months13. When a compliance rule draws sustained objection, the agency's own statements become the best guide to what it will accept — the BIR quoted sellers' concerns verbatim in its retreat33. Monitoring those statements is more useful than monitoring the volume of complaints.

See the full picture behind today's signals.

This report draws from Media Meter's MediaWatch, our real-time monitoring engine tracking 2,470+ Philippine sources across print, broadcast, digital, and social. Explore how the platform turns raw coverage into decision-grade intelligence, then see how it's configured for teams like yours — whether you're in PR agencies, corporate comms, government, or marketing.

Want more? Browse our Report Library for sector and crisis intelligence, or request a demo and we'll have your brand set up before the call.