China: State Internet Information Office closes consultation on Internet Application Personal Information Collection and Use Regulations including data protection regulation

On 9 February 2026, the State Internet Information Office closes the consultation on Internet Application Personal Information Collection and Use Regulations including data protection regulation. The Regulations apply to internet applications. Application providers are primarily responsible for complying with data protection obligations in relation to their applications, while application distribution platforms must also review listed applications and smart terminal manufacturers must review pre-installed applications. The Regulations would require data collection and processing to proceed according to principles of legality and necessity, and on the basis of data subject consent, with additional protections for information classified as state secrets or communication secrets. Article 7 requires operators to disclose data collection rules and embedded software development kit (SDK) details, with any changes to processing practices to be reflected in prompt rule changes. Large applications, defined as having over 50 million registered users or 10 million monthly active users, must solicit public opinion for at least 7 days on any rule change. The Regulations also set out rules for specific data processing situations, such as accessing phone address books, camera and microphone, processing biometric data, and minors' data. Applications must allow users to disable personalised recommendations and conveniently cancel user accounts, following which user information must be deleted within 15 days. The Regulations also establish data protection requirements for SDKs, including specifying version-specific rules for personal information collection and use, function-based configuration, and personalised recommendation opt-out options to host applications, while promptly responding to user data requests.