Collect only personal information an app needs, obtain guardian consent for children under 14 and explain practices clearly
China's rules require necessity and guardian consent for children under 14. Violations first bring correction orders and possible app suspension. Refusal can bring up to RMB 1 million, with RMB 10,000–100,000 for responsible staff. Serious cases can bring up to RMB 50 million or 5% of the preceding year's turnover, with RMB 100,000–1 million for responsible people, potentially including developers and product staff.
What it takes
Free. Before release, compare requested permissions with the privacy policy and remove unnecessary permissions. Product teams' desire to retain data “for later” can make this difficult.
What you may gain
Personal-information processing must have a clear, reasonable purpose, be directly related to it and minimize effects on individual rights. Consent or another statutory basis is required; processing children's information under age 14 requires parental or guardian consent. Regulators may order correction, warn, confiscate proceeds and suspend or terminate unlawful apps. Refusal to correct can bring up to RMB 1 million and RMB 10,000–100,000 for responsible managers and directly responsible staff. Serious cases can bring up to RMB 50 million or 5% of prior-year turnover, plus RMB 100,000–1 million for responsible people. Those people may also be barred for a period from director, supervisor or senior-management roles in relevant enterprises. Criminal provision or sale of information is discussed in entry 4. These rules apply throughout China.
Context & considerations
In practice, “directly responsible people” can include programmers and product staff. MIIT regularly announces removal of noncompliant apps; no specific bulletin was verified for this chapter, so none is cited.
Research & references
NPC Standing Committee (2021). Personal Information Protection Law, Articles 6, 13, 31 and 66. http://www.npc.gov.cn/npc/c2/c30834/202108/t20210820_313088.html