BEIJING: China’s cyberspace regulator has released draft rules aimed at strengthening personal data protection in internet applications, seeking public feedback on measures that would limit how apps collect and use user information.
The draft, issued on Saturday by the Cyberspace Administration of China, is designed to safeguard personal information rights and ensure the lawful and appropriate use of personal data across digital platforms. The proposed rules would directly affect internet application developers and millions of users across China.
According to the draft, internet applications would be required to collect and use personal information only to the extent necessary for providing their products or services, and must not exceed that scope. The regulator said the move is intended to curb excessive data collection and improve transparency.
Clear consent and limited data access
Under the proposed rules, applications would be required to clearly inform users, upon first launch, about how personal information is collected and used. This information must be presented prominently, such as through pop-up notifications, and explicit user consent must be obtained.
The draft also restricts applications from collecting or using personal information of individuals other than the user by accessing address books, call logs, or SMS data. Such access would be permitted only when necessary for specific functions, including communication, adding contacts, or data backup.
Rules for sharing data with third parties
In cases where personal information is provided to third parties, the draft requires applications to obtain separate consent from users. The regulator said this provision is aimed at giving users greater control over how their data is shared beyond the original platform.
The Cyberspace Administration of China said public feedback will be used to refine the draft before the rules are finalized, as part of broader efforts to strengthen data governance and user privacy in China’s digital economy.
