Filed under app-compliance
Every brief tagged "app-compliance".
- § 01 · ENFORCEMENT
MPS Testing Center Names 35 Apps for Personal-Information Violations: A Finance-Heavy Batch, and 15 Takedowns From the Last One
On October 30, 2026, the National Cybersecurity Notification Center published a Ministry of Public Security notice: the MPS Computer Information System Security Product Quality Supervision and Testing Center found 35 mobile apps collecting or using personal information unlawfully. The apps were tested between August 17 and September 11, 2026. This is the first notice in the MPS app-testing series that DCC has covered, and DCC translates it in full with a consolidated table of all 35 apps. Collection and use without the user's consent accounts for 30 of the 46 findings. The other seven categories, each cited against one to seven apps, cover incomplete or inaccurate notice, unlisted third-party sharing, permissions requested without stating their purpose, forced consent to non-necessary data, collection beyond the necessary scope, no effective account cancellation, and no convenient channel to exercise rights. The batch leans heavily toward finance: by their names alone, at least ten are wealth-management, fund, brokerage, or stock-picking apps. Every app was sampled from a mainstream app store, with Apple's the largest source. The notice also reports that 15 of the previous batch's 42 apps failed retest and were taken down by distribution platforms.
- § 02 · ENFORCEMENT
MIIT Public-Naming Bulletin 2026 Batch 5 (Total Batch 58): 26 Apps and SDKs Named, With Auto-Renewal, Misleading Downloads, and Non-Compliant Use in the Findings
On August 25, 2026, MIIT's Information and Communications Administration Bureau issued its fifth public-naming bulletin of 2026 (total Batch 58), citing 26 apps and SDKs for conduct infringing user rights. DCC translates the bulletin and the full 26-entry annex, taken from the PDF on MIIT's website. The findings run to 48 across eleven categories. Seventeen entries drew non-compliant collection of personal information, and eight drew non-compliant use, a category absent from Batch 4. Two categories reach past personal information altogether: a non-compliant auto-renewal service and deceiving or misleading users into downloading an app. Seven of the 26 are education or study apps, two of them gaokao application planners. A city-run media center, a piano maker, and three SDKs, one an ad SDK, complete the profile.
- § 03 · ENFORCEMENT
MIIT Public-Naming Bulletin 2026 Batch 6 (Total Batch 59): 17 Apps and SDKs Named, With Mini-Programs, Forced Targeted Push, and Store-Listing Disclosure in the Findings
On October 15, 2026, MIIT's Information and Communications Administration Bureau issued its sixth public-naming bulletin of 2026 (total Batch 59), citing 17 apps and SDKs for conduct infringing user rights. DCC translates the bulletin and transcribes the 17-entry image table in full. The findings run to 30 across eleven categories. Fourteen entries drew non-compliant collection of personal information. Two categories are new to the MIIT batches DCC has covered: inadequate display of app information on a distribution platform, and swipe-triggered window redirects. Two more, non-compliant use of personal information and forcing users to accept targeted push, first appeared in Batch 5. Eight of the 17 were sampled inside super-apps rather than app stores: three WeChat mattress-brand mini-programs, an Alipay mini-program, a Douyin listing, and three Kuaishou listings. Three Android SDKs, one of them an ad SDK cited for inadequate SDK information disclosure, complete the list.
- § 04 · ENFORCEMENT
CVERC Names 82 Apps for PI Violations, and 28 From Its August Batch Are Now Off the Stores
On 23 September 2026 the National Computer Virus Emergency Response Center (国家计算机病毒应急处理中心, CVERC) named 82 mobile apps whose collection and use of personal information failed its testing, carried out between 29 July and 4 September under the 2026 CAC + MIIT + MPS joint special campaign. The notice is published as text, and DCC translates it in full: twelve violation categories, 118 findings, and every app, consolidated into one table. Three things set it apart from the MIIT and CAC notices in DCC's tracker. First, a published retest loop: of the 75 apps CVERC named in August, 28 still failed on retest and have been taken down by the distribution platforms. Second, the taxonomy has moved past the 2019 Identification Method into PIPL's statutory text. Five categories track PIPL Articles 23, 24, 30, 31 and 51 almost word for word: separate consent for sharing with another handler, an opt-out from automated-decision push, notice of why sensitive personal information is needed, dedicated rules for children under 14, and security measures. Third, the perimeter: 29 mini-programs on WeChat, Baidu and Alipay, three WeChat service accounts, two TV apps, a standalone ad SDK, and twelve builds downloaded from third-party download sites. Eight hospital channels are named, among them United Family Healthcare's mini-program, and hospitals account for four of the eleven findings of sharing personal information without separate consent.
- § 05 · ENFORCEMENT
MIIT Public-Naming Bulletin 2026 Batch 4 (Total Batch 57): 32 Apps and SDKs Cited for PI Violations, Excessive Permission Demands, and SDK Disclosure Failures
On July 2, 2026, MIIT's Information & Communications Administration Bureau issued its fourth public-naming bulletin of 2026 (total Batch 57), citing 32 apps and SDKs for infringing user rights — non-compliant and beyond-scope collection of personal information, forced/frequent/excessive permission demands, frequent self-start and associated start, uncloseable and redirect-abusing information windows, and inadequate SDK information disclosure. The batch runs under the same 2026 CAC + MIIT + MPS special campaign as the earlier CAC notification and Shanghai takedown covered in DCC's enforcement tracker, on the same rectify-or-face-disposition pathway. DCC transcribes the full 32-entry list from the bulletin's attached image table. The profile: a mobility-and-transport long tail (ride-hailing driver apps, EV charging, bus-information tools) alongside recognizable names — Neta Auto's app, PetroChina Kunlun's charging app, NetDragon's fortune-telling app, iFlyPlus — plus two WeChat mini-programs, multiple Apple App Store listings, one developer named twice, and three SDKs, one of which (闪登 SDK) drew four separate findings including the headline SDK-disclosure failure.
- § 06 · ENFORCEMENT
From Naming to Takedown: Shanghai Pulls 46 Apps That Missed the Rectification Window
On June 24, 2026 the Shanghai Communications Administration (上海市通信管理局, the MIIT's directly-administered local communications authority) issued a notification ordering the takedown of 46 apps and SDKs that, after public naming and a rectification window, still had not fixed user-rights and personal-information violations. DCC reads it as the next rung on the enforcement ladder above the CAC's 30-app naming notification: same 2026 CAC + MIIT + MPS special campaign, but the local communications-administration tier converting an unrectified naming into an operative sanction — removal from distribution, with further measures flagged (suspension of access, administrative penalty, inclusion in the telecom-business bad-record list). The legal basis is PIPL, the Cybersecurity Law, the Telecom Regulations, and the Telecom and Internet User PI Protection Provisions. The 46-app list — transcribed here from the notice's attached image — is almost entirely Shanghai-registered long-tail O2O lifestyle apps (moving, housekeeping and cleaning, pet services, local travel agencies, community group-buy food, fitness and restaurants), and several operators appear with multiple apps taken down at once. DCC's read for overseas counsel: the provincial communications administrations are where a missed rectification window becomes a removed app, and the takedown tier sweeps the small-operator long tail, not just big nationals.