Takeaways
-
The State Council proposes to formulate the Provisions on Safeguarding Minors’ Healthy and Safe Use of the Internet. Focusing primarily on minors’ modes, restrictions on specific types of services, and the identification of minor users, the proposed Provisions establish, for the first time, a filing obligation for minors’ modes, requiring internet service providers and manufacturers of smart terminals to make filings with provincial-level cyberspace authorities.
-
The Cyberspace Administration of China (CAC) releases a new batch of enforcement cases involving, among other violations, the use of facial information collected at business premises for marketing purposes without obtaining separate consent; the cross-border transfer, without a security assessment, of non-conventional data such as information on software and hardware usage; the failure to fulfil applicable AIGC obligations when providing AI services through API; and the direct removal of WeChat mini programs for failing to comply with AIGC labelling obligations.
-
The Supreme People’s Court (SPC) issues its first judicial adjudication rules concerning artificial intelligence, providing guidance on disputed issues including infringements of personality rights arising from AI-enabled face-swapping and voice imitation, online doxxing, the use of personal information in model training, and mechanisms for allocating responsibility between platforms and users.
-
Overseas data regulatory enforcement continued this month. Google was fined EUR 403 million by the Irish data protection authority over its processing of location data. TikTok withdrew its appeal against the United Kingdom’s penalty decision concerning children’s privacy and accepted a fine of GBP 12.7 million.
Regulatory Highlights
State Council Proposes to Formulate the Provisions on Safeguarding Minors’ Healthy and Safe Use of the Internet
From September 18 to October 17, CAC solicited public comments on the Provisions of the State Council on Safeguarding Minors’ Healthy and Safe Use of the Internet. The Draft for Comments primarily covers three categories of responsible entities: internet service providers, manufacturers of smart terminal products, and application distribution platforms. General-purpose services and devices are also subject to the Draft for Comments if they provide services to minors. The key provisions are as follows:
First, the national cyberspace administration proposes to improve the regulation of minors’ modes and introduce a filing mechanism for the first time. The Draft for Comments requires internet service providers, manufacturers of smart terminal products, and application distribution platforms to establish minors’ modes. Internet service providers and manufacturers of smart terminal products, in particular, must make filings with provincial-level cyberspace authorities and submit basic information. Platforms with an enormous number of users and significant influence must make filings with the national cyberspace administration through the provincial-level cyberspace authorities.
At the center of this regulatory framework are internet service providers. Their core obligations are to identify minor users through methods such as real-name authentication, facial verification, and behavioral identification; review algorithms and manage content, including by intervening in cases involving self-harm or suicide; and, depending on the type of service, activate minors’ mode or cease providing the relevant service. Specifically, prohibited services include online social networking with strangers, virtual intimate relationships, the broadcasting of livestreams (except for minors aged 16 or above), services that induce induce addiction or may seriously harm minors’ physical or mental health. Other services prohibited by laws and regulations include payments for online games, virtual gifting during livestreams, and the game account leasing. Online audio and video services, livestreaming services other than livestream broadcasting, online games, social networking services, and AI services that may affect minors’ cognition must be provided through minors’ mode.
Manufacturers of smart terminal products and application distribution platforms must also establish minors’ modes under the Draft for Comments. Smart terminal products must coordinate with the minors’ modes of installed applications and support one-click switching, exit verification, safeguards against circumvention, and controls over usage periods, duration, functions, and content. Application distribution platforms, in turn, are subject to corresponding app admission control obligation. They must apply strict scrutiny to applications seeking listing or updates in minors’ modes and take measures, such as restricting the download or installation of applications unsuitable for the applicable age group.
CAC Releases Recent Typical Enforcement Cases in Cybersecurity, Data Security, Personal Information Protection and Related Fields
Key points of note include the following:
-
In the case involving the mandatory collection and use of unnecessary personal information by an information technology company in Zhejiang, the App involved required users to grant multiple permissions, including access to their location and phone, purportedly to “prevent cheating” in its running function, which was unavailable to users who refused. Conditioning the service on such bundled consent was found to violate the Personal Information Protection Law.
-
In the case involving the unlawful collection of facial information by a real estate company in Chongqing, the company involved installed image-capturing devices in its offices to collect and store customers’ facial information and used it for identity verification and marketing analysis without obtaining separate consent. The case confirmed that separate consent must be obtained before any collection and used of facial information for marketing purpose.
-
In the case involving the excessive collection and unlawful cross-border transfer of personal information by a technology company in Shanghai, the company involved used its Windows application to collect data on users’ hardware configurations, usage duration, and operating systems, and transferred the data overseas together with user registration information without undergoing a security assessment. The case confirmed that cross-border data transfer requirements apply to software and hardware usage data as well as other conventional personal information.
-
In the case involving failure to label AI-generated content by a mini program operated by a technology company in Sichuan, the AIGC WeChat mini program involved failed to identify its content as AI-generated, add the required visible and invisible labels, or conduct the required security assessment. The mini-program was therefore ordered offline, demonstrating the consequences of non-compliance for AI service providers.
-
In the case involving failure to conduct required security assessment for generative AI services by a Jiangsu technology company, the company involved operated two websites that used APIs to access multiple large language models and provide conversational and question-answering services, without conducting the required security assessment. The case confirmed that using APIs to access third-party AI models does not exempt service providers from the applicable AIGC compliance requirements.
SPC Issues the Opinions on the Lawful Adjudication of Cases Involving Artificial Intelligence Disputes
-
The Opinions were issued by SPC on September 7, being the first judicial adjudication rules issued by SPC concerning artificial intelligence. The Opinions contain 24 articles divided into five parts: general provisions, the adjudication of AI-related tort cases, the adjudication of AI-related intellectual property disputes, procedural rules for adjudicating AI-related disputes, and guidance for adjudication. A significant number of the provisions concern personal information. The key points are as follows:
-
The Opinions provide specific criteria for determining infringements of personality rights involving AI-enabled face and voice imitation, online doxxing, and similar conduct, and establish a mechanism for allocating liability between users and platforms. Using an individual’s name, likeness, or voice without consent to generate identifiable virtual image or synthetic voice may infringe that person’s rights to their name, likeness and voice. Using AI to track and analyze an individual’s publicly available information to obtain or even disclose private information may infringe the individual’s right to privacy. Upon receiving notice from a rights holder, a generative AI service provider must take necessary measures, such as stopping the generation of infringing content or blocking the relevant prompts. Otherwise, it shall bear tort liability.
-
The Opinions clarify the reasonable boundaries for using publicly available personal information for model training. An AI service provider may use lawfully disclosed personal information for model training within a reasonable scope without obtaining prior consent, except where the individual has expressly objected or the processing has a significant impact on the individual’s rights. The reasonable scope should be assessed by considering the purpose, necessity, and appropriateness of the processing, the sensitivity of the information, the context of its disclosure, and the individual’s reasonable expectations.
-
The Opinions clarify the legal protection and infringement standards for AI developers’ lawfully acquired rights in data. Datasets may be protected as compilations or other works under copyright law, or as trade secrets. In addition, the Anti-Unfair Competition Law and the Anti-Monopoly Law regulate operators that use data or algorithms to enter into monopoly agreements or abuse a dominant market position, as well as conduct that undermines the operational security of AI through fabricated disruptive data, malicious labeling, adversarial example attacks, or similar means.
-
The source of training data is considered in determining AI developer’s copyright infringement liability. Where an AI developer raises a non-infringement defense, it must provide materials concerning the sources of its training data, records of the training process, the model’s operating mode, and other relevant matters.
-
The Opinions clarify the allocation of liability in scenarios involving physical AI products, autonomous vehicles, and vehicles equipped with driving-assistance functions. Producers and sellers of AI products shall bear liability for damage caused by product defects. Vehicle manufacturers and sellers shall likewise bear corresponding liability for damage arising from traffic accidents caused by vehicle defects.
Internet Regulation
On September 1, the State Administration for Market Regulation publicly solicited comments on the Compliance Guidelines for Online Trading Mini-Program Platforms. The Guidelines require mini-program platform operators to establish and publish service agreements containing provisions on personal information protection. Any proposed amendments must be open to public comment and published at least seven days in advance.
Artificial Intelligence
On September 2, the Ministry of Industry and Information Technology issued the Implementation Plan for the “AI + Software” Special Action, proposing to promote the use of intelligent programming tools among 20,000 large scale software enterprises by 2028.
According to information published by CAC, as of August 31, a total of 1,112 generative artificial intelligence services had completed filing, and 731 generative artificial intelligence applications or functions had completed registration. On September 23, CAC published filing information for three providers of on-device generative artificial intelligence services for mobile.
Cross-Border Data Transfers
In its September policy and regulatory Q&A on data export security administration, CAC clarified the applicable circumstances and applying methods for the cross-border personal information transfer certification, as well as the coordination between certification and security assessment. Personal information processors of any size may apply to a professional certification body for certification of cross-border personal information transfers. However, those meeting the thresholds for a mandatory security assessment must undergo the assessment as required by law, with any existing certification results taken into account.
On September 28, the Beijing Economic-Technological Development Area issued new implementation opinions on the data export negative list. Corresponding to the data export negative list (2025 edition) and the revised administrative measures issued in June, the scope of application was expanded to the entire Development Area, with medical devices, trade and logistics, banking and other sectors newly included.
On September 15, Guangdong Government Service and Data Management Bureau issued the Work Plan for Developing a Data Special Zone in the Guangdong-Hong Kong-Macao Greater Bay Area. The Plan calls for supporting Guangzhou in cooperating with emerging South American markets, Southeast Asian countries, and Belt and Road countries in areas such as intelligent connected vehicles, cross-border e-commerce, overseas expansion of gaming businesses, the BeiDou industry, and the hydrogen energy industry. It also calls for developing international cooperation platforms in Shenzhen, Hengqin, and Shantou, including data security and compliance laboratories, international digital trade hubs, and ‘Two Countries, Twin Parks’ projects with Brazil, Nigeria, and Kenya.
Data Enforcement
Regular APP supervision has progressed steadily in August. On September 1, the Quality Supervision and Inspection Center for Information Security Products, Ministry of Public Security reported 42 mobile applications that were illegally or non-compliantly collecting and using personal information. On September 11 and 22, the National Computer Virus Emergency Response Center identified a total of 157 such apps. On September 15, Cyber Security Association of China reported that nine APPs across five categories, including mail express, recruitment, education, online car-hailing, and app stores, had completed personal information related corrective actions. On September 20, CAC reported 30 APPs and mini programs that were illegally or non-compliantly collecting and using personal information.
On September 21, the Supreme People’s Procuratorate released typical cases concerning procuratorial technical support for high-quality and efficient case handling. In one case, Zhejiang procuratorates used a specialized electronic data laboratory and key forensic appraisal centers across the province to provide integrated technical support. Techniques such as program reverse engineering and emulation were used to examine 50 apps from different sectors in a centralized personal information public interest litigation initiative led by the provincial procuratorate. A regulatory platform was also used to monitor 11,660 apps and mini-programs in real time, resulting in the removal of 27 non-compliant apps.
On September 2, CAC reported progress in the second phase of the “Qinglang: Rectifying Misconduct in AI Applications” special action. Targeting prominent issues such as the use of AI to create and disseminate false information, spread violent or vulgar content, impersonate others, and infringe minors’ rights, the campaign removed over 5.61 million pieces of unlawful or non-compliant information, took action against more than 49,000 accounts, and dealt with over 2,400 non-compliant websites, applications, and other services.
On September 17, the Ministry of Public Security reported the interim results of the “Clean Net 2026” special action and published ten typical cases involving the crackdown on and rectification of cyber-related violations and crimes.
On September 30, CAC launched a two-month “Qinglang: Rectifying False Personas in Short Videos” special action, targeting prominent issues such as the use of AI to impersonate public figures and individuals involved in widely discussed events.
Shanghai’s “Liangjian Pujiang 2026” Special Law Enforcement Action for the Online Protection of Minors made positive progress. Cultural law enforcement authorities filed and investigated 12 cases involving issues such as gaming addiction and excessive spending; public security cybersecurity authorities solved more than 10 cases involving cyberbullying against minors and other violations; and procuratorial authorities addressed 40 criminal cases involving telecommunications and online fraud participated by minors, remote molestation, and offenses against minors following online contact, and handled 11 public interest litigation cases of various types.
Data Standards
On September 24 and 28, the State Administration for Market Regulation approved and released 39 national standardization guiding technical documents and 466 recommended national standards, including numerous standards concerning artificial intelligence and information technology.
On September 17, SAC/TC260 released three standards practical guides, including the Technical Guidelines for Information Sanitization of Smart Mobile Terminals. Issued in support of the mandatory national standard GB 46864-2025, Data Security Technology: Technical Requirements for Information Erasure in Electronic Products, the guidelines cover block erasure of semiconductor storage media, information erasure during electronic product recycling, and information erasure on mobile smart terminals.
Worldwide News
On September 29, the U.S. Court of Appeals for the Third Circuit ruled in a copyright infringement case concerning ROSS Intelligence’s use of Westlaw headnotes to develop a legal research tool. Considering that the product developed by ROSS and Westlaw were both legal research tools and were highly substitutable, and that the use could harm Westlaw’s existing business and potential licensing market, the court held that ROSS’s use did not constitute fair use.
On September 19, Vietnam issued Decree No. 363/2026/ND-CP on Penalties for Administrative Violations in the Field of Data. The Decree will take effect on November 11, 2026, and, together with the previously issued Decree No. 330/2026/ND-CP on Penalties for Administrative Violations in the Fields of Cybersecurity and Personal Data Protection, establishes Vietnam’s data protection penalty framework. Enterprises may face a maximum fine of VND 200 million (about USD 7,700) for a single violation, as well as other penalties such as suspension of relevant business activities or restoration, correction or deletion of data.
In 2023, the UK Information Commissioner’s Office (ICO) fined TikTok GBP 12.7 million (about USD 17.2 million) for failing to adequately identify child users on its platform or to clearly explain how children’s personal information was processed. TikTok subsequently appealed. On September 24, TikTok formally withdrew its appeals and accepted the fine. The ICO’s separate investigation, launched in February 2025, into TikTok’s processing of the personal information of users aged 13 to 17 through its recommender systems will also resume.
On September 21, Google was fined EUR 403 million by the Irish Data Protection Commission over its processing of location data, mainly involving three features: “Web & App Activity” in Google Accounts, “Location History” in Google Maps, and “Location Accuracy” in the Android operating system.
