ChinaProvisions on Security Management of Facial Recognition Technology Application
人脸识别技术应用安全管理办法 issued jointly by the Cyberspace Administration of China and the Ministry of Public Security, signed , effective
In force since .
A biometric privacy rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- These duties bind the deployment and use of facial recognition; Article 2 exempts facial-recognition R&D and algorithm-training activities from the Measures. Obtain separate, explicit, informed, voluntary consent before collecting or using facial recognition data, with guardian consent for anyone under 14, and use the method with the least impact on individual rights available.NIST Privacy FrameworkCT.PO-P1
- Store captured facial information only on the recognition device itself; do not transmit it over the internet unless a legal exception applies or the individual has separately consented.NIST Privacy FrameworkCT.DP-P1
- Retain facial information no longer than the minimum time necessary for the stated purpose.NIST Privacy FrameworkCT.PO-P2
- Offer a non-facial-recognition verification alternative whenever one exists; do not make facial recognition the sole means of identity verification.NIST Privacy FrameworkCT.PO-P3
- Do not install facial recognition devices inside hotel rooms, public bathhouses, public changing rooms, or public restrooms.NIST Privacy FrameworkCT.PO-P1
- File with the provincial-level cyberspace administration once the stored facial-information count reaches 100,000 individuals.NIST Privacy FrameworkGV.PO-P5
These lines are LexLint's reading of the law's text. Also read by: Cyberspace Administration of China (国家互联网信息办公室), the national cyberspace department that coordinates personal information protection and supervision under the Personal Information Protection Law (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CT.DP-P1Data are processed to limit observability and linkability (e.g., data actions take place on local devices, privacy-preserving cryptography).
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
The Cyberspace Administration's Q&A of January 2026 construes the Article 9 impact assessment only; it does not address the consent, storage, alternative-method or filing duties of these Measures.
- As of
- Guidance link
- https://www.cac.gov.cn/2026-01/09/c_1769688003183197.htm
- Guidance body
- Cyberspace Administration of China (国家互联网信息办公室), the national cyberspace department that coordinates personal information protection and supervision under the Personal Information Protection Law
- Open questions
- When does a non-facial method exist that serves 实现相同目的或者达到同等业务要求 ("achieves the same purpose or meets an equivalent business requirement") so that Article 10 bars facial recognition as the sole means of verification?
- What makes an alternative 其他合理、便捷的方式 ("other reasonable and convenient means") for an individual who declines identity verification by facial information under Article 10?
What it makes you log
Who may demand the log
Regulator
Log retention
Applies to the impact assessment report and the processing record kept under Article 9.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 3
Logging duty
Article 9 requires a handler applying facial recognition to conduct an impact assessment in advance and to record the processing, and to keep the assessment report and the processing record for at least three years. Article 15 adds the impact assessment report to the filing a handler with facial information on 100,000 people makes with the provincial cyberspace administration, and Article 16 has the protection departments supervise and inspect, with the handler's cooperation. Article 14 requires the application system to use measures including security audit and access control, which names no log contents. Article 8 limits how long facial information itself is kept, which is storage limitation and not a log retention period. Article 2 exempts research and algorithm-training use.
- Kind
- Explicit
- As of
- Provision
- Facial Recognition Measures, Arts. 9 and 15
- Trigger
- personal_data_processing
What this law does
China's first dedicated facial-recognition regulation requires voluntary, explicit, separately-obtained consent before capturing facial information, with guardian consent for a minor under 14, and requires using the method with the least impact on individual rights available.
It mandates that facial data be stored on the collecting device rather than transmitted over the internet absent a legal exception or separate consent, caps retention at the minimum necessary period, bars facial recognition as the sole identity-verification method wherever another method exists, bans facial recognition devices inside private spaces within public venues such as hotel rooms and changing rooms, and requires a processor holding facial data on 100,000 or more people to file with the provincial cyberspace authority.
No comparably dedicated voiceprint regulation exists; a January 2026 CAC draft for public comment would extend this same on-device-storage approach to fingerprint and voiceprint data, but it had not been finalized as of the date shown and is not authored as its own instrument here. Article 2 carves facial-recognition R&D and algorithm-training activities out of the Measures' scope, so the duties below bind deployment and use, not model training (第二条: 不适用本办法的规定).
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .