Every brief.
The full run, most recent first.
- § 07 · CONSENT
One Signature, Two Documents: A Beijing Financial Court Ruling and the Case for Asking for Less Consent
A bank customer buying RMB 100,000 of savings bonds signed electronically three times; the bank applied the first signature both to the bond slip and to a 'Personal Information Authorization Letter'. The courts held the authorization was never formed, at first instance and on appeal, where the Beijing Financial Court ruled on December 30, 2024 ((2024)京74民终1694号). The bank had not drawn attention to the document, the customer did not stop to read it, and there was no sign of the separate tick-box step the letter itself required. 数据何规 (What Rules for Data) agrees with the courts' scrutiny of what the customer knew. It parts company with their reasoning, which treats PI consent as contractual mutual assent. Following Cheng Xiao and Gao Fuping, the author argues that consent under the PIPL is not a declaration of intent, and that withdrawing consent is not rescinding a contract. The practical point is the larger one: where PIPL Article 13 supplies another legal basis, such as performing the contract or a statutory obligation, don't ask for consent at all. Proper notice is then enough.
- § 08 · FIVE-YEAR-PLAN
What the 15th Five-Year Informatization Plan Signals for AI and Data Compliance Through 2030
数据何规 (What Rules for Data) reads the Central Cyberspace Affairs Commission's 15th Five-Year Plan for National Informatization, published October 23, 2026, for what it means for AI and data compliance over the next five years. Foundational AI legislation and judicial interpretations on AI and personal information are now formal tasks, though the law's name, form, and timing are not settled. On AI regulation, the plan pairs an unexplained 'optimization' of generative AI filing with a new security risk assessment system for applications in key sectors, and with assessment and filing for AI agents, on-device large models, and anthropomorphic services. The author reads that as a shift from model-level to use-level scrutiny. On data, the author reads cross-border facilitation as clearer boundaries and lower costs for the three existing export routes, not their abolition, and notes that it runs alongside the CAC's special inspections of data export. The plan also singles out personal information testing of smart devices and biometric information management. The author's bottom line: a plan creates no new obligations, but it marks where the next rules will land.
- § 09 · MINORS
Draft State Council Provisions on Minors' Internet Use: A Ban on Stranger Social Networking, Minors' Mode by Default Under 16, and Filing for Devices and Platforms
On September 18, 2026, the Cyberspace Administration of China (CAC) released the draft State Council Provisions on Ensuring Minors' Healthy and Safe Use of the Internet for public comment. Comments closed October 17, 2026. DCC has translated the 25 articles, the notice, and the CAC's Explanation in full. Against the 2024 Regulations on the Protection of Minors in Cyberspace, the draft adds five things. It bans online social networking with strangers for minors (except self-supporting 16- and 17-year-olds), and extends the virtual-intimacy ban from AI companions to all network services. It makes minors' mode the only way to serve under-16s with audio and video, live-streaming, games, social networking, and AI services that may affect minors' cognition. It turns minor-user identification into a stand-alone duty, with methods that include one-time facial verification and behavioral recognition. It reaches smart terminal manufacturers and app distribution platforms. And it creates a minors' mode filing system: providers that offer a minors' mode file with the provincial cyberspace administration, while platforms identified as having a very large number of minor users and a significant impact on minors file with the national cyberspace administration through the provincial office and report on their minors' mode. Fines reach 10 times illegal gains or RMB 1 million. The effective date is blank, but the year reads 2026.
- § 10 · MINORS
CAC Opens the First Identification Round for 'Article 20' Platforms: Who Must Self-Report a Large Minor Audience, and by When
On October 16, 2026, the Cyberspace Administration of China (CAC) launched the first round of identification under the Measures for Identifying Network Platform Service Providers with a Very Large Number of Minor Users and a Significant Impact on Minors (国信办发文〔2026〕2号, effective April 1, 2026). DCC translates the announcement and its work guide in full. Platforms that meet the numeric thresholds must self-assess and file within 20 working days, which on DCC's count lands in mid-November 2026. The thresholds are 10 million registered or 1 million monthly active users for minor-directed services, and 10 million registered or 1 million monthly active minor users for general-audience services. Platforms caught by a six-factor impact test are expected to file too. Paper filings go to the provincial cyberspace administration. Platforms on the final list take on the extra duties of Article 20 of the Regulations on the Protection of Minors in Cyberspace: minors-impact assessments, a minors' mode, an independent external supervisory body, platform rules, and an annual social responsibility report. For serious breaches of two of them (the impact assessment, and cutting off harmful on-platform businesses), Article 54 allows fines of up to RMB 50 million or 5% of the previous year's turnover.
- § 11 · ENFORCEMENT
MIIT Public-Naming Bulletin 2026 Batch 5 (Total Batch 58): 26 Apps and SDKs Named, With Auto-Renewal, Misleading Downloads, and Non-Compliant Use in the Findings
On August 25, 2026, MIIT's Information and Communications Administration Bureau issued its fifth public-naming bulletin of 2026 (total Batch 58), citing 26 apps and SDKs for conduct infringing user rights. DCC translates the bulletin and the full 26-entry annex, taken from the PDF on MIIT's website. The findings run to 48 across eleven categories. Seventeen entries drew non-compliant collection of personal information, and eight drew non-compliant use, a category absent from Batch 4. Two categories reach past personal information altogether: a non-compliant auto-renewal service and deceiving or misleading users into downloading an app. Seven of the 26 are education or study apps, two of them gaokao application planners. A city-run media center, a piano maker, and three SDKs, one an ad SDK, complete the profile.
- § 12 · ENFORCEMENT
MIIT Public-Naming Bulletin 2026 Batch 6 (Total Batch 59): 17 Apps and SDKs Named, With Mini-Programs, Forced Targeted Push, and Store-Listing Disclosure in the Findings
On October 15, 2026, MIIT's Information and Communications Administration Bureau issued its sixth public-naming bulletin of 2026 (total Batch 59), citing 17 apps and SDKs for conduct infringing user rights. DCC translates the bulletin and transcribes the 17-entry image table in full. The findings run to 30 across eleven categories. Fourteen entries drew non-compliant collection of personal information. Two categories are new to the MIIT batches DCC has covered: inadequate display of app information on a distribution platform, and swipe-triggered window redirects. Two more, non-compliant use of personal information and forcing users to accept targeted push, first appeared in Batch 5. Eight of the 17 were sampled inside super-apps rather than app stores: three WeChat mattress-brand mini-programs, an Alipay mini-program, a Douyin listing, and three Kuaishou listings. Three Android SDKs, one of them an ad SDK cited for inadequate SDK information disclosure, complete the list.