China

Article 20 of the Cybersecurity Law, added by the Decision of the Standing Committee of the National People's Congress adopted on October 28, 2025, provides that the State supports basic theory research and key technology development in artificial intelligence, advances infrastructure such as training data resources and computing power, improves artificial intelligence ethics norms, strengthens risk monitoring and assessment and safety regulation, and promotes the application and healthy development of artificial intelligence.

Its second paragraph provides that the State supports innovating cybersecurity management methods by using new technologies such as artificial intelligence to raise the level of cybersecurity protection. Both paragraphs are framed as what the State supports or does, and neither states a duty on a developer or operator of an AI system. The Decision takes effect on January 1, 2026.

Article 11 of the Interim Measures for the Management of Generative AI Services requires a provider to perform, in accordance with law, its protection obligations for users' input information and usage records, and bars it from collecting personal information that is not necessary. The article bars a provider from unlawfully retaining input information and usage records that can identify the user, and from unlawfully providing them to others.

A provider must promptly accept and handle, in accordance with law, an individual's request to access, copy, correct, supplement or delete that individual's personal information.

Article 14 of the Interim Measures for the Management of Generative AI Services requires a provider that discovers illegal content to promptly stop generating it, stop transmitting it, eliminate it, carry out rectification such as retraining the model, and report to the relevant competent authority.

The article separately requires a provider that discovers a user has used the service for illegal activity to warn, restrict, suspend, or terminate that user's access, preserve relevant records, and report to the relevant competent authority, and it states no promptness standard for that second reporting duty.

Both duties name only the relevant competent authority as addressee, without naming the Cyberspace Administration of China by title, and this reporting duty is distinct from the content-labeling duty the same Act imposes at Article 12.

Article 10 of the Provisions on the Administration of Deep Synthesis Internet Information Services requires a deep synthesis service provider to strengthen its management of deep synthesis content, review users' input data and synthesis output by technical or manual means, build a database of features for identifying illegal and undesirable information, and record and retain the related network logs.

Where the provider discovers illegal or undesirable information, the article requires it to take disposal measures and preserve relevant records in accordance with law, and to promptly report the discovery to the cyberspace administration department and the relevant competent authority, while separately taking measures such as warning, restricting features, suspending service, or closing the account against the user responsible.

Only the reporting step in that sentence carries the word 'promptly' in the text; the disposal and record-preservation steps that precede it carry no separate promptness standard of their own.

Article 1019 provides that no organization or individual may infringe another person's portrait right by defacing or disfiguring the portrait, or by forging it with information technology means. Article 1019 also provides that, unless the law provides otherwise, no one may make, use, or publicly disclose a person's portrait without the portrait right holder's consent.

Article 1018 defines a portrait as the external image of a specific natural person, reflected on a carrier through images, sculpture, painting or similar means, by which that person can be identified. Article 1023 provides that the protection of a natural person's voice applies by reference the provisions on the protection of the portrait right.

Article 1020 permits, without the portrait right holder's consent, reasonable acts such as using an already public portrait within the necessary scope for personal study, art appreciation, classroom teaching, or scientific research, and unavoidably making, using, or publicly disclosing a portrait in news reporting. The Civil Code took effect on 1 January 2021.

Article 14 bars a provider of anthropomorphic interactive services from offering minors services of virtual intimate relationships such as virtual relatives or virtual partners. Article 14 requires a provider to obtain the consent of a minor's parents or other guardians before offering its other anthropomorphic interactive services to a minor under fourteen.

Article 14 requires a provider to establish a minors mode with personalized safety settings such as mode switching, periodic reality reminders and usage-time limits, and to let guardians receive safety-risk reminders, see an overview of the minor's use, block specific characters and limit spending.

Article 14 requires a provider, while protecting user privacy and personal information, to take effective measures to identify minor users, to switch an identified minor's service to the minors mode or take other measures under national rules, and to provide a channel for appeal.

Article 7 requires a provider to carry out pre-training and optimization-training data processing in accordance with law, using data and base models from lawful sources. Article 7, item 2 provides that where intellectual property is involved, a provider must not infringe the intellectual property rights others hold under law.

Article 7, item 3 requires a provider, where personal information is involved, to obtain the individual's consent or to meet another circumstance that a law or administrative regulation sets. Article 7, item 4 requires a provider to take effective measures to raise the quality of training data and to strengthen its truthfulness, accuracy, objectivity and diversity.

Article 8 requires a provider that labels data during generative AI research and development to set clear, specific and operable labeling rules, assess labeling quality, check a sample of labeled content for accuracy and give labelers the necessary training.

Providers of anthropomorphic AI interactive services, products that simulate a human personality and engage in emotionally-styled conversation, must take effective measures to remind users that they are interacting with an AI service rather than a natural person, at first use and at re-login, and must dynamically re-notify users through a prominent method such as a pop-up when the system detects signs of over-reliance or addiction, or when continuous use exceeds two hours.

This is narrower than a general bot-disclosure duty: it reaches only anthropomorphic, companion-style AI interaction services, not every chatbot or AI-assisted tool. Issued jointly by the Cyberspace Administration of China, the National Development and Reform Commission, the Ministry of Industry and Information Technology, the Ministry of Public Security, and the State Administration for Market Regulation on 10 April 2026, finalized from a 27 December 2025 public-comment draft.

Providers of generative AI services to the Chinese public must label generated content such as images and video in accordance with the Deep Synthesis Provisions' Article 16 and 17 labeling rules. This is a cross-reference duty binding generative-AI providers specifically to the general deep-synthesis labeling regime, not a freestanding labeling standard of its own.

Article 7 of the same instrument governs training-data lawfulness and has no labeling content; it is training-data territory outside this topic's scope, correcting an earlier derivation that had cited it here.

Internet information service providers must add an explicit, user-perceptible marker to AI-generated or AI-synthesized text, image, audio, video, and virtual-scene content, and must embed an implicit, machine-readable identifier in file metadata carrying generation attributes and the provider's name or code. Content-distribution platforms must check incoming content for labels and add a risk prompt to unlabeled or suspected-generated content.

No person or organization may maliciously delete, alter, forge, or conceal a required label. The accompanying mandatory national standard GB 45438-2025 sets the technical parameters for both label types and takes effect the same date; no official standards-body URL for GB 45438-2025 is available independent of a commercial reseller, so it is described here rather than authored as its own instrument.

Article 6 requires a provider of online information content dissemination services to check whether a file's metadata contains an implicit label and, where the metadata marks the content as AI-generated, to add a prominent notice around the published content that clearly reminds the public that it is AI-generated or synthetic.

Where no implicit label is found in the metadata but the user has declared the content AI-generated, Article 6 requires the provider to add a prominent notice around the published content reminding the public that it may be AI-generated or synthetic.

Where there is no implicit label and no user declaration but the provider detects an explicit label or other traces of generation, Article 6 requires the provider to identify the content as suspected AI-generated and add a prominent notice around it reminding the public of that. Article 6 also requires the provider to supply the necessary labeling function and to remind users to declare whether the content they publish contains AI-generated content.

In the first three cases, Article 6 requires the provider to add the content's generation attribute information, the dissemination platform's name or code and a content number to the file metadata.

Deep-synthesis service providers must apply a technical measure to label content generated or edited using their service without interfering with normal use, and retain log information as required.

Where a listed category of service could cause public confusion, simulated dialogue or writing, synthesized or altered voice, face generation or face-swap, or immersive simulated-scene generation, the provider must apply a prominent label alerting the public to the deep-synthesis nature of the content. This is the earliest of China's four labeling instruments and is the one the 2023 Generative AI Interim Measures cross-references.

China's first dedicated facial-recognition regulation requires voluntary, explicit, separately-obtained consent before capturing facial information, with guardian consent for a minor under 14, and requires using the method with the least impact on individual rights available.

It mandates that facial data be stored on the collecting device rather than transmitted over the internet absent a legal exception or separate consent, caps retention at the minimum necessary period, bars facial recognition as the sole identity-verification method wherever another method exists, bans facial recognition devices inside private spaces within public venues such as hotel rooms and changing rooms, and requires a processor holding facial data on 100,000 or more people to file with the provincial cyberspace authority.

No comparably dedicated voiceprint regulation exists; a January 2026 CAC draft for public comment would extend this same on-device-storage approach to fingerprint and voiceprint data, but it had not been finalized as of the date shown and is not authored as its own instrument here. Article 2 carves facial-recognition R&D and algorithm-training activities out of the Measures' scope, so the duties below bind deployment and use, not model training (第二条: 不适用本办法的规定).

Upon discovering an actual or possible leak, tampering, or loss of personal information, a handler must immediately take remedial measures and notify both the department responsible for personal information protection and the affected individuals, with the notice covering the categories of information involved, the cause, possible harm, remedial measures, mitigation steps for individuals, and the handler's contact information.

Individual notice may be omitted where remedial measures can be shown to effectively prevent harm, unless the supervisory department requires notice anyway. The statute requires action taken immediately rather than setting a fixed numeric deadline such as 72 hours.

China's omnibus personal-data statute (Ge Ren Xin Xi Bao Hu Fa, Personal Information Protection Law) requires a lawful basis, most commonly informed consent, before processing personal information, and otherwise contract necessity, statutory duty, public-interest journalism, information the individual or another lawfully disclosed, or another legal ground.

It imposes purpose-limitation and data-minimization duties, requires a handler that entrusts processing to a third party to supervise that processor's activity under an agreement, and assigns joint and several liability among two or more processors who jointly decide a shared processing purpose and method. Chapter II, Section 3 (Arts. 33-37) extends parallel duties to state organs, so the Act binds government processors as well as private ones.

Article 4 of China's Personal Information Protection Law defines personal information as all kinds of information, recorded electronically or otherwise, relating to an identified or identifiable natural person, and names anonymized information as the category that definition excludes.

Article 73, item 4 defines anonymization as processing personal information so that a specific natural person cannot be identified and the information cannot be restored, and item 3 defines de-identification as processing personal information so that it cannot identify a specific natural person without the aid of additional information.

The Law's text gives de-identified information no exclusion from the definition of personal information, and Article 51, item 3 lists encryption, de-identification and similar technical security measures among the measures a personal information handler takes, according to the purpose and method of the processing, the type of personal information, the impact on individuals' rights and interests and the security risks, to prevent unauthorized access and the leakage, tampering and loss of personal information.

Article 54 of the Personal Information Protection Law requires a personal information handler to audit, at regular intervals, its compliance with laws and administrative regulations in processing personal information. Under the Measures for the Administration of Personal Information Protection Compliance Audits, a handler that audits itself does so through its own internal body or by commissioning a specialized institution.

A handler that processes the personal information of more than 10 million people must conduct a compliance audit at least once every two years. A handler that processes the personal information of 1 million or more people must designate a person in charge of personal information protection who is responsible for its compliance audit work.

A handler that provides an important internet platform service, has a very large number of users and runs complex types of business must set up an independent body made up mainly of external members to oversee its compliance audits. The Measures took effect on 1 May 2025. The Measures do not apply to a compliance audit of a state organ or of an organization authorized by law or regulation to manage public affairs.

Article 38 requires one of a CAC-organized security assessment, personal-information-protection certification, a CAC standard contract, or another state-recognized mechanism before transferring personal information outside China, plus assurance the overseas recipient meets PIPL's protection standard. Article 39 requires advance notice naming the recipient and purpose and separate consent.

Article 40 requires domestic storage for critical information infrastructure operators and above-threshold handlers, with export gated on a security assessment. The 2024 CAC Provisions on Promoting and Regulating Cross-Border Data Flows (a separate instrument) substantially relax these mechanisms by transfer volume.

This CAC regulation relaxes PIPL Article 38's cross-border transfer mechanisms by transfer volume, recited in the CAC promulgation notice. Exporting under 100,000 individuals' non-sensitive personal information in a year, or a listed necessary-business category such as contract performance, cross-border human-resources management, or emergency protection of life or property, needs no security assessment, standard contract, or certification at all.

Exporting 100,000 to under 1,000,000 individuals' non-sensitive personal information, or under 10,000 individuals' sensitive personal information, needs a standard contract or certification. Exporting 1,000,000 or more individuals' non-sensitive personal information, or 10,000 or more individuals' sensitive personal information, or any export by a critical information infrastructure operator, needs the full CAC security assessment. Free trade zones may adopt their own negative lists further narrowing what requires a mechanism.

Individuals have the right to know about and decide on processing, and to limit or refuse it (Art. 44), the right to access and copy their data including portability to another handler under state conditions (Art. 45), the right to correction or completion (Art. 46), the right to deletion in enumerated circumstances with cessation of active processing as a fallback where deletion is technically infeasible (Art. 47), and the right to an explanation of processing rules (Art. 48).

Article 50 requires a convenient exercise mechanism, a reasoned explanation for any refusal, and permits a court suit if a request is unreasonably denied.

Article 24's first paragraph requires a personal information processor using personal information for automated decision-making to ensure the decision-making is transparent and its results are fair and impartial, and bars unreasonable differential treatment of individuals in transaction conditions such as price.

Its second paragraph requires a non-personalized option or a convenient way to decline wherever information push or commercial marketing toward an individual is itself carried out by means of automated decision-making. Its third paragraph gives an individual the right to an explanation and the right to refuse a decision made solely through automated decision-making where that decision has a major effect on their rights and interests.

Article 55(2) requires a processor to carry out a personal-information-protection impact assessment in advance, and keep a record of the processing, before using personal information to conduct automated decision-making.

Article 56 requires that assessment to cover whether the purpose and method of the processing are lawful, legitimate and necessary, the impact on individual rights and the security risk, and whether the protective measures taken are lawful, effective and proportionate to the risk, with the assessment report and processing record kept for at least three years.

The Cyberspace Administration of China leads coordination, with sectoral State Council departments and their local counterparts supervising within their own scope; investigative powers include interviews, record examination, on-site inspection, and, with approval, seizure of equipment.

Ordinary violations draw a warning, confiscation of gains, and service suspension, escalating on non-correction to fines up to RMB 1,000,000 for the entity and RMB 10,000 to 100,000 for the responsible individual; grave violations draw fines up to RMB 50,000,000 or 5 percent of the prior year's revenue, possible business suspension or license revocation, individual fines of RMB 100,000 to 1,000,000, and a bar on serving as a director, supervisor, senior manager, or protection officer of a related enterprise.

A handler that cannot prove itself free of fault bears civil compensation liability, and procuratorates and designated organizations may bring public-interest suits over mass violations.

Article 28 defines sensitive personal information as information whose leak or misuse would easily harm dignity or personal or property safety, expressly including biometric identification information (covering both faceprint and voiceprint as instances of the same category) alongside religious belief, specific identity, medical health, financial accounts, and location tracking, and extends automatically to a minor's information under 14.

Article 29 requires separate, explicit consent before processing any sensitive personal information, layered on top of the general lawful-basis requirement, Article 30 requires advance notice of necessity and impact, and Article 31 requires guardian consent for a minor's data. The biometric definition carries no exclusion for an identifier extracted from an existing photo, video, or audio recording.

Article 285(1) criminalizes intrusion into state-affairs, defense, or advanced-science computer systems; Art. 285(2), added by the 2009 Amendment VII, reaches intrusion into any other computer information system, or use of other technical means, to obtain data stored, processed, or transmitted in that system, or to exercise illegal control over it, where the circumstances are serious; Art. 286 criminalizes destroying a computer system's function, data, or programs.

A 2011 joint interpretation of the Supreme People's Court and the Supreme People's Procuratorate sets quantitative thresholds for 'circumstances serious' (such as five hundred or more sets of authentication credentials, or unlawful gains of 5,000 yuan or more) and defines a program or tool as one specially built for unauthorized intrusion when it functions to circumvent or break through a system's security-protection measures, or to obtain that system's data without authorization or beyond the scope of authorization granted.

Article 285(2) reaches intrusion and any other technical means used to obtain a system's data, and its text carries no exception for data the system makes public.

Article 24 sets out a closed list of permitted uses that do not require the copyright holder's consent or payment: personal study, brief quotation for commentary, unavoidable reproduction in news reporting, and reprinting current-affairs commentary absent a reservation, among others. There is no general fair-use clause and no text-and-data-mining exception, so training an AI model on scraped copyrighted content has no dedicated statutory basis under this article.

Courts have so far worked the fair-use-adjacent question through AI output cases rather than collection: the Guangzhou Internet Court found AI-generated images infringing in February 2024 (secondary-sourced, the Ultraman case), while the Hangzhou Internet Court held in September 2024, upheld that December, that training itself can be lawful absent intent to plagiarize expression or unreasonable prejudice to the rightholder (secondary-sourced); neither directly answers whether scraping for training is itself permitted.

Article 27 permits a personal information handler to process, within a reasonable scope, personal information an individual has disclosed themselves or that is otherwise lawfully public, unless the individual has expressly declined; processing that has a significant impact on the individual still needs separate consent.

Article 13(6) states the same ground as a general lawful basis for processing, functioning as China's analog to General Data Protection Regulation (GDPR) Art. 6(1)(f), with its own reasonable-scope ceiling and opt-out rather than a legitimate-interest balancing test. The 2023 Generative AI Interim Measures additionally require a lawful source for AI training data, which for personal information means satisfying this Article 27 basis; those Measures do not name robots.txt as part of that requirement.

The third paragraph of the amended Article 13 prohibits a business operator from obtaining or using, by fraud, coercion, or by evading or destroying technical management measures, data lawfully held by another business operator, where doing so harms that operator's lawful rights and interests and disrupts market competition order. It took effect October 15, 2025.

It codifies the result courts had already reached under the law's older general clause: Beijing IP Court held in Sina Weibo v. Maimai (Dec.

2016, secondary-sourced) that reusing API data after a partnership ended was unfair competition under a triple-authorization principle, and Shanghai Pudong New Area People's Court held in Hantao (Dianping) v. Baidu (26 May 2016, secondary-sourced) that spidering reviews into a competing product was an unfair substantive substitute for the source's own product.

A provider of a network product or service must ensure the product or service meets the mandatory requirements of the relevant national standard and must not embed a malicious program in it. On discovering that its product or service has a security defect, vulnerability, or other risk, the provider must immediately take remedial measures and, as provided, promptly notify users and report to the competent authority.

The provider must continuously maintain the product's or service's security and must not terminate that maintenance within the period fixed by regulation or agreed with the user. Where the product or service collects user information, the provider must disclose that collection and obtain consent, and, where personal information is involved, comply with this Law's and the Personal Information Protection Law's rules on personal information.

An ordinary violation draws a corrective order, a warning, and a fine of 50,000 to 500,000 yuan if the provider refuses to correct or the violation endangers network security, with a further escalation, cross-referenced from Article 61's third paragraph, of 500,000 to 2,000,000 yuan for causing a large-scale data leak or the loss of a local function of critical information infrastructure, and 2,000,000 to 10,000,000 yuan where critical information infrastructure loses a primary function.

The Measures bind telecommunications business operators and internet domain name service providers as to the public communications network and the internet they manage and run. An operator must divide its networks in operation into units and grade each unit from level 1 to level 5 by the harm its destruction could cause to national security, economic operation, social order and the public interest.

A unit graded level 3 or above must undergo a conformity assessment once a year, and a level 2 unit once every two years. An operator that breaches the listed articles and refuses to correct after an order receives a warning and a fine of 5,000 to 30,000 yuan.

The Regulation protects critical information infrastructure, meaning important network facilities and information systems in public communications and information services, energy, transport, water, finance, public services, e-government and defense science and technology, and in other fields where destruction, loss of function or data leakage could seriously harm national security, the national economy or the public interest.

The protection-work department of each sector designates the critical information infrastructure of its sector under its designation rules, notifies the operator of the result and informs the public security department of the State Council. An operator must plan, build and put into use its security protection measures at the same time as the infrastructure. An operator must set up a dedicated security management body and run security background checks on the body's head and on key-post staff.

An operator must carry out a cybersecurity inspection and risk assessment of the infrastructure at least once a year, either itself or through a cybersecurity service organization. An operator must give priority to secure and trustworthy network products and services and must put a purchase that may affect national security through the national cybersecurity review.

An operator that commits a listed failure receives an order to correct and a warning, and a fine of 100,000 to 1,000,000 yuan if it refuses to correct or the failure endangers cybersecurity.

Article 2 of the Cybersecurity Law applies to the construction, operation, maintenance and use of networks within China and to the supervision and administration of network security. Article 23 requires a network operator to perform the security protection duties that the classified protection system for cybersecurity sets. Article 23 requires the network operator to formulate internal security management rules and operating procedures and to designate a person responsible for network security.

Article 23 requires the network operator to take technical measures against computer viruses, network attacks and network intrusions. Article 23 requires the network operator to monitor and record the network's operating status and security incidents, to keep the network logs for not less than six months, and to take data classification, backup of important data and encryption measures.

Article 61 provides that a network operator that does not perform the Article 23 duties is ordered to correct, is warned, and may be fined 10,000 to 50,000 yuan. Article 81 states that the Law takes effect on 1 June 2017.

Any organization or individual engaging in a data-processing activity must, under the law and administrative regulations, establish and improve a full-process data-security management system, organize data-security education and training, and take the technical measures and other necessary measures appropriate to keep the data secure.

Where a data-processing activity is conducted using the internet or another information network, this data-security duty applies on top of, not instead of, the network operator's classified-protection duty under the Cybersecurity Law. A processor of important data must designate a person responsible for data security and a managing body, and implement that responsibility.

An ordinary violation draws a corrective order and a warning, escalating to a fine of 50,000 to 500,000 yuan, with a further escalation to 500,000 to 2,000,000 yuan for refusing to correct or causing a large-scale data leak or another serious consequence; a violation of the separate national core data management system carries its own, heavier fine of 2,000,000 to 10,000,000 yuan and can draw criminal liability, but that heavier tier is not this duty.

A network operator that finds or learns that its network, information system or equipment has a security vulnerability must take measures at once, verify the vulnerability in good time and complete its repair. Article 5 also requires a network operator to keep its channel for receiving vulnerability information open and to keep the receipt logs for at least 6 months.

Where an operator does not take the repair or preventive measures the Provisions require, the competent authorities handle it according to law, and Article 13 sends a case that amounts to the situation described in Article 59 of the Cybersecurity Law to that Law's penalty. Article 27 of the Cybersecurity Law as amended on 28 October 2025 requires a network operator to formulate a cybersecurity incident emergency plan and to deal in good time with security risks such as system vulnerabilities.

Article 61 of that Law provides a warning and a fine of 10,000 to 50,000 yuan for failing the duties in Articles 23 and 27 and, where the operator refuses to correct or the violation endangers network security, a fine of 50,000 to 500,000 yuan.

When critical information infrastructure suffers a major cybersecurity incident, or a major cybersecurity threat is found, the operator must report to the protection-work department and the public security organ as the relevant provisions require. For an especially major incident or threat, the protection-work department must in turn report promptly to the national cyberspace department and the public security department of the State Council.

An operator that fails to report receives an order to correct and a warning, and a fine of 100,000 to 1,000,000 yuan if it refuses to correct or the failure endangers cybersecurity.

Any organization or individual engaging in a data-processing activity must strengthen risk monitoring and, on discovering a data-security defect, vulnerability, or other risk, immediately take remedial measures. On an actual data-security incident, the organization or individual must immediately take disposal measures, promptly notify affected users as provided, and report the incident to the competent authority.

The statute sets no numeric deadline for that notice or report, only immediacy and promptness; the National Cybersecurity Incident Reporting Measures set an operative reporting clock for such an incident, but bind by a network-operator classification recorded in the jurisdiction summary rather than raised as an instrument here.

The penalties for a violation are the same tiered fines as this jurisdiction's Data Security Law data-security-program row, since Article 45 punishes a failure under Articles 27, 29, and 30 together.

A network operator that builds or operates a network, or provides a service through a network, within the territory of China must report a cybersecurity incident under these Measures. These Measures define a network operator as the owner, manager, or network service provider of a network.

These Measures also define a cybersecurity incident as an event that, due to human causes, a network attack, a network vulnerability or hidden danger, a hardware or software defect or malfunction, force majeure, or another factor, harms a network or information system or the data and business applications within it and has a negative impact on the state, society, or the economy.

On discovering or becoming aware of an incident involving its own unit, a network operator must grade the incident against the annexed National Cybersecurity Incident Classification and Grading Guide and report only where the grade is relatively major or above. Where the incident involves critical information infrastructure, the operator must report to the sector's protection-work department and to the public security organ within 1 hour of discovering or becoming aware of it.

A network operator that is a department of a central or state organ, or a directly affiliated unit of one, must report to its own department's cyberspace affairs unit within 2 hours. Every other network operator must report to the cyberspace administration department of its own province within 4 hours.

A major or especially major incident escalates further between the government bodies that received the operator's report, up to the national cyberspace administration, without imposing any additional step on the reporting operator itself.

A network operator must require, by contract, any organization or individual providing it network-security or system-operation-and-maintenance services to promptly report to it any cybersecurity incident that provider discovers through monitoring, and to assist the operator's own reporting under these Measures.

Within 30 days of completing disposal of a relatively major incident or above, the operator must submit a summary report on the incident's cause, its emergency response, the harm caused, accountability, remediation, and lessons learned, through the same channel used for the original report.

A failure to report as required draws a penalty under other law, and reporting late, missing a report, or filing a false or concealed report that causes major harm draws a heavier penalty on the operator and its responsible persons. An operator that took reasonable and necessary protective measures, disposed of the incident under its emergency plan, effectively reduced the incident's impact, and reported it as required may be treated leniently or not held accountable at all.

A report involving a state secret follows the rules of the relevant department instead of the general channel described here.

A network data processor that finds a security defect, vulnerability or similar risk in a network product or service it provides must take remedial measures at once, tell users as required and report to the competent department. Where the defect or vulnerability endangers national security or the public interest, the processor must also report to the competent department within 24 hours.

When a network data security incident occurs, the processor must start its emergency plan at once, act to stop the harm spreading and report to the competent department as provided. A breach of the provisions of the Regulation that its penalty articles do not list is held to the Cybersecurity Law, the Data Security Law and the Personal Information Protection Law.

A provider of a network product, hardware or software, must report a security vulnerability it finds or learns of in a product it provides to the vulnerability information sharing platform of the Ministry of Industry and Information Technology within 2 days. The report must state the product name, model and version and the vulnerability's technical features, harm and scope of impact.

Where users must upgrade software or firmware, the provider must promptly tell the users who may be affected the risk and the repair method and give necessary technical support. A provider must keep the receipt logs of its vulnerability information channel for at least 6 months.

A provider that fails to take the vulnerability repair or reporting measures the Provisions require is handled by the Ministry of Industry and Information Technology and the Ministry of Public Security according to their duties. Article 12 provides that a failure of that kind which amounts to the situation described in Article 60 of the Cybersecurity Law is penalized under that provision.

In the Cybersecurity Law as amended on 28 October 2025, Article 62 lists among the penalized acts that a provider has not taken remedial measures at once on a security defect, vulnerability or other risk in its product or service, or has not told users in time as required and reported to the competent authority. Article 62 provides for a warning and, where the provider refuses to correct or the violation endangers network security, a fine of 50,000 to 500,000 yuan.

A person that discovers or collects network product vulnerabilities and publishes vulnerability information to the public through a network platform, the media, a conference or a competition must not publish it before the product's provider has provided a repair measure, unless it considers earlier publication necessary, assesses the matter with the provider, reports to the Ministry of Industry and Information Technology and the Ministry of Public Security, and publishes only after those ministries have organized an assessment.

It must publish a repair or preventive measure at the same time as the vulnerability. It must not publish the details of a vulnerability in a network, information system or equipment that a network operator is using. It must not give undisclosed vulnerability information to an organization or individual outside China other than the product's provider. It must not publish a vulnerability during a major national event without the consent of the Ministry of Public Security.

A vulnerability collection platform set up by any organization or individual must be filed with the Ministry of Industry and Information Technology.

Article 14 provides that collecting or publishing vulnerability information in breach of the Provisions is handled by the Ministry of Industry and Information Technology and the Ministry of Public Security according to their duties, and that a case amounting to the situation described in Article 62 of the Cybersecurity Law is penalized under that provision.

In the Cybersecurity Law as amended on 28 October 2025, Article 65 provides a warning and a fine of 10,000 to 100,000 yuan for carrying out security certification, testing or risk assessment, or publishing system vulnerability information to the public, in breach of Article 28, and a fine of 100,000 to 1,000,000 yuan where the violator refuses to correct or the circumstances are serious.

A financial practitioner institution must report a cybersecurity incident in a business area the People's Bank of China supervises to the People's Bank of China or its branch at the institution's place of domicile. After an incident of the relatively major grade or above, the institution must send a brief incident report within 1 hour and an incident report within 24 hours. For a major incident or above, the institution must send a progress report at least every 2 hours until handling ends.

Within 10 working days after handling ends, the institution must send a post-incident investigation summary report. The Measures provide that a failure to report is penalized under the Cybersecurity Law.

Limits all online game service providers to offering minors no more than one hour of game time per day, only between 20:00 and 21:00 on Fridays, Saturdays, Sundays and legal holidays, with no game service to minors at any other time. Requires every online game account to be registered under a real identity linked to the National Press and Publication Administration's national anti-addiction real-name verification system, and bans guest-mode access.

Requires providers of online games, livestreaming, audio-video and social networking services to build in time management, permission management and spending management functions for minor users, and requires online game providers to use a unified national electronic identity system to verify that game accounts are registered under the user's real identity, with no game service offered to minors between 22:00 and 08:00.

Implementing regulation requiring game, livestream, audio-video and social platforms to provide a minor mode limiting usage time, functions and content per national standards, to reasonably cap single and cumulative spending by minors by age band, to prevent traffic-driven inducements such as fan voting campaigns aimed at minors, and to display age-appropriate ratings prominently at download and login.

Bars livestreaming service providers from issuing a livestreaming anchor (content creator) account to anyone under 16, and requires providers to obtain a parent or guardian's consent and verify identity before issuing an anchor account to a 16 or 17 year old.

Article 23 gives a network service provider that offers a search or link service a safe harbour from damages liability once, on receiving a rights holder's written notice, it disconnects the link to the allegedly infringing work, unless it knew or should have known that the linked work was infringing, in which case it bears joint infringement liability.

That safe harbour runs through the same notice-and-counter-notice mechanism the Regulation gives a hosting provider under Article 22: Article 14 requires a rights holder's takedown notice to name the rights holder, identify the work and its network address, and include preliminary proof of infringement; Article 15 requires the provider to act on it immediately, forwarding the notice to the party that supplied the material; and Articles 16-17 let that party submit a written counter-statement to have the material or link restored, after which the rights holder may not issue a further notice over the same material.

The Regulation was promulgated by State Council Order No. 468 on 18 May 2006 and amended by a State Council decision dated 30 January 2013; the currently effective text's own commencement article states an effective date of 1 July 2006. No reported Chinese decision applies Article 23 specifically to a news aggregator's display of links to third-party journalism, as opposed to file-hosting or search-engine link cases generally.

Article 5(2) excludes 单纯事实消息 (unofficial rendering: "the news of the day", i.e. pure factual news reports) from copyright protection outright, so a bare news item is never a protected work under Chinese law whichever outlet reports it first.

Article 24 separately sets a closed list of uses that need neither the copyright holder's consent nor payment provided the author and title are credited and the use does not unreasonably prejudice the copyright holder: item (2) permits appropriately quoting a published work in another work to introduce, comment on, or explain it; item (3) permits unavoidably reproducing or quoting an already-published work when reporting news in a newspaper, periodical, radio, or television broadcast; and item (4) permits a newspaper, periodical, radio station, or television station to reprint or broadcast another such outlet's already-published current-affairs article on political, economic, or religious questions, unless the copyright holder has declared reprinting or broadcasting impermissible.

None of these exceptions is capped at a headline-length or short-extract threshold, and no reported Chinese court decision applies them to a systematic news aggregator's reproduction of headlines and snippets as opposed to conventional news reporting or quotation.

Article 5 requires any organisation providing an internet news information service to the public, including a news-reprinting service or a news-dissemination platform service, to first obtain an internet news information service licence, and bans operating such a service without one or beyond its scope.

Article 6 conditions that licence on the applicant being a legal person lawfully established within China, having a PRC-citizen principal officer and editor-in-chief, and maintaining dedicated editorial, content-review, and technical-security staff and systems; an entity applying specifically to gather and publish news must itself be a news organisation or a unit under a news-and-propaganda department's supervision.

Article 11 requires a licensed provider to appoint an editor-in-chief who bears overall responsibility for its news content and to register that person with the cyberspace administration.

Article 15 conditions any reprinting of news information on sourcing it only from central news organisations or provincial-level and above news organisations within a state-designated list, on crediting the original source, author, original headline, and editor, on not distorting the original headline's meaning or the news content, on keeping the source traceable, and on separately complying with copyright law.

This is a licensing and content-control regime enforced by the Cyberspace Administration of China, distinct from and additional to the Copyright Law's own exceptions, and no equivalent duty runs to an aggregator that only links to, rather than reprints, another outlet's news.