Promulgated by: Ministry of Industry and Information Technology.
Document No.: 工信部信管函〔2023〕26号 (Gong Xin Bu Xin Guan Han [2023] No. 26).
Dated February 6, 2023. The Notice states no separate effective date and applies from issuance.
Translation note — DCC. 开发运营者 is rendered “developer and operator”, meaning the party responsible for an app. 公示 is rendered “publicly disclose” or “publicly display”, and 明示 “clearly display”. 违规 is rendered “non-compliant”, not “unlawful”, as in the glossary. Item numbering restarts in each Part, so a provision is cited as, for example, “Part II, item 7”.
To the communications administrations of all provinces, autonomous regions and municipalities directly under the Central Government; the China Academy of Information and Communications Technology (CAICT) and the Internet Society of China; and all relevant enterprises:
In recent years, the Ministry of Industry and Information Technology has vigorously promoted improvements in the quality of mobile internet application services and effectively safeguarded the lawful rights and interests of users, achieving positive social results. However, problems such as non-standard service conduct by some enterprises and inadequate implementation of responsibilities at relevant links still occur from time to time. In order to optimize the supply of services, improve the user experience, maintain a sound information consumption environment, and promote the high-quality development of the industry, and in accordance with the Personal Information Protection Law, the Telecommunications Regulations, the Several Provisions on Regulating the Market Order of Internet Information Services, the Provisions on Protecting the Personal Information of Telecommunications and Internet Users, and other relevant laws, administrative regulations and rules, the relevant matters are hereby notified as follows:
I. Improving Service Perception Across the Whole Process and Protecting Users’ Lawful Rights and Interests
(I) Standardize installation and uninstallation conduct
1. Ensure installation with informed consent. Recommending that users download an app shall follow the principles of openness and transparency. Necessary information such as the developer and operator, product functions, privacy policy and permission list shall be clearly displayed in a truthful, accurate and complete manner, an obvious cancel option shall be provided at the same time, and the app may be downloaded and installed only after the user confirms consent, so as to effectively safeguard users’ right to know and right to choose. Users shall not be deceived or misled into downloading and installing apps by means such as “bait-and-switch” (偷梁换柱), “forced bundling” (强制捆绑) or “silent download” (静默下载).
2. Standardize download recommendations on web pages. While a user is browsing page content, apps shall not be downloaded automatically or forcibly without the user’s consent or active choice, and users shall not be forced to download or open an app by means such as collapsed display, proactive pop-ups or frequent prompts that interfere with their normal browsing of information. Without a justifiable reason, downloading an app shall not be tied to reading web page content.
3. Enable convenient uninstallation. Except for software providing basic functions, apps shall be conveniently uninstallable. Users shall not be maliciously obstructed from uninstalling by means such as blank names, transparent icons or hiding in the background.
(II) Optimize the service experience
4. Let users choose to close windows. Splash-screen and pop-up information windows shall provide clear and effective close buttons so that users can close them conveniently. Pop-ups shall not appear so frequently as to interfere with users’ normal use, and users shall not be induced to take actions by means prone to accidental triggering, such as “full-screen heat maps” (全屏热力图) or high-sensitivity “shake” (摇一摇) gestures.
5. Inform users of service terms in advance. Product functions, entitlements, fees and similar content shall be clearly displayed; where there are additional conditions such as signing up for a membership or paying charges, a prominent notice shall be given. Without having clearly displayed them, no restrictive conditions shall be added without authorization in the course of providing products and services and then used as grounds to terminate product functions and services the user has been using normally, or to degrade the service experience.
6. Start and run only in reasonable scenarios. Where it is not necessary for the service or there is no reasonable scenario, an app shall not self-start, or associated-start other apps, or engage in waking up, invoking, updating or similar conduct.
7. Remind users promptly of service renewal. Where services are provided on an auto-subscription or auto-renewal basis, the user’s consent shall be obtained, and such services shall not be activated through pre-ticked boxes or forced bundling. Users shall be reminded five days before an auto-subscription or auto-renewal by text message, push notification or another prominent means, and during the service period a convenient way to unsubscribe at any time and channels to cancel auto-subscription and auto-renewal shall be provided.
(III) Strengthen personal information protection
8. Adhere to the principles of lawfulness, legitimacy and necessity. Personal information processing activities shall have a clear and reasonable purpose. Users shall not be compelled to consent to personal information processing that goes beyond the scope or is unrelated to the service scenario on grounds solely of service experience, product research and development, algorithmic recommendation, risk control or the like. Where a user refuses to provide personal information that is not necessary for the current service, this shall not affect the user’s use of the basic functions of that service.
9. Clearly display personal information processing rules. Users shall be informed of the personal information processing rules in a concise, clear and easy-to-understand manner and, if the rules change, promptly informed of the latest position. The purposes, methods and scope of processing sensitive personal information shall be highlighted, and a list of the personal information collected shall be established. Users shall not be induced to agree to personal information processing rules by means such as pre-ticked boxes, reduced font size or lengthy text.
10. Request and use permissions reasonably. Required permissions shall be requested dynamically when the corresponding business function is launched; users shall not be required to give bundled consent to multiple permissions that are not necessary for the business function in question. When invoking permissions such as the device’s photo album, contacts or location, users shall at the same time be informed of the purpose of requesting the permission. Without the user’s consent, the status of permissions the user has not authorized shall not be changed.
(IV) Respond to user demands
11. Set up customer service hotlines. Internet enterprises are encouraged to establish customer service hotlines. Major internet enterprises are to publicly display their customer service hotline numbers in a prominent position on their websites and apps and to simplify the procedure for transfer to a live agent. Enterprises are encouraged to improve the responsiveness of their hotlines, with a monthly average response time of no more than 30 seconds and a live-agent answer rate above 85%.
12. Handle user complaints properly. Valid contact details shall be published and user complaints accepted. Complaints on the internet information service complaint platform shall be answered as the applicable norms require and handled to completion within 15 days, and the complaint-handling satisfaction rate shall be improved. Enterprises are encouraged to provide a user-satisfaction evaluation link in their apps and to guide users to take part in evaluations.
II. Improving Management Capabilities Across the Whole Chain and Building a Healthy Service Ecosystem
(I) Implement the primary responsibility of app developers and operators
1. Improve internal management mechanisms. Designate the lead management department and the person responsible for user services and rights protection, establish a full-lifecycle personal information protection mechanism, improve the assessment and accountability system, and carry relevant legal, regulatory and policy requirements into every link of product research and development, promotion and operation, continuously raising the level of compliance. Conduct regular compliance audits of personal information protection measures and their implementation, effectively preventing risks and hidden dangers.
2. Strengthen technical safeguard capabilities. Take security technical measures such as access control, encryption and de-identification, and strengthen front-end and back-end security protection. Proactively monitor for and discover risks and threats such as the leakage, theft, tampering, damage, loss and illegal use of personal information, and respond promptly to disposition requirements.
3. Strengthen the management of software development kit (SDK) use. Before using an SDK, assess its personal information protection capabilities, and clearly agree the rights and obligations of each party by contract or in other forms, to ensure that personal information processing is lawful and compliant. Display in a centralized place, and promptly update, the names and functions of embedded SDKs and their rules for processing personal information. Where user personal information is jointly processed and user rights and interests are infringed, causing damage, the parties shall bear corresponding liability in accordance with the law.
(II) Strengthen distribution management by platforms
4. Conduct strict listing review of apps. Accurately register and verify basic information such as the true identity and contact details of the app’s developer and operator and the app’s main functions and uses, and conduct technical testing of apps proposed for listing. A person responsible shall be designated for the relevant reviews and review logs retained; apps that do not meet the requirements shall not be listed. Publicly disclose all listed apps in full, and indicate in a prominent position information such as the app’s name and functions, developer and operator, version number, list of required user-device permissions and their purposes, and personal information processing rules. Where a distribution display interface has not yet been established, app downloads shall be linked to an app store, guiding users to download the distributed apps through legitimate channels.
5. Strengthen inspection of listed apps. Strengthen dynamic inspection of apps to ensure that publicly disclosed information is true and accurate. Stop providing services to non-compliant apps that are inconsistent with the publicly disclosed information, or that change their main functions, the permissions they request, or the scenarios and scope of personal information collection and use without authorization by means such as “hot updates” or “hot switching”.
6. Improve distribution management mechanisms. Establish mechanisms such as credit evaluation of and risk alerts on app developers and operators. Electronic signature authentication of distributed apps is encouraged, so that listed applications and distribution conduct are traceable throughout the process. Strengthen coordination with the public service platform for the testing and certification of mobile internet applications, and carry out information reporting, monitoring and tracing, information sharing, and response and disposition.
(III) Standardize SDK application services
7. Establish an information disclosure mechanism. Publicly and clearly disclose basic information such as the SDK’s name, developer, version number, main functions and instructions for use, as well as its personal information processing rules. Where an SDK independently collects, transmits or stores personal information, a separate explanation shall be given. SDK management service platforms are encouraged to play their role in guiding app developers and operators to use compliant SDKs.
8. Optimize functional configuration. Following the principle of minimum necessity, clarify SDK functions and the corresponding scope of personal information collection according to different application scenarios or purposes, and provide app developers and operators with configuration options for functional modules and personal information collection. Personal information shall not be collected excessively on a bundled basis.
9. Strengthen service coordination. Throughout the lifecycle of product use, proactively provide app developers and operators with compliance-use guidance in a clear and easily understood manner, guiding them to use the SDK correctly and reasonably and jointly raising the level of compliance. When personal information processing rules change or risks are discovered, promptly update them and inform app developers and operators.
(IV) Build a strong line of defense in device security
10. Strengthen management of app operation. Provide users with functions to switch off apps’ self-start and associated start, as well as convenient options to reset the relevant device identifiers. Strengthen monitoring of apps’ silent downloads and hot updates, and prevent conduct such as starting, downloading or installing without the user’s consent.
11. Strengthen recording of and reminders about app behavior. Enhance the capability to record permission invocations, and make it easy for users to look up how permissions have been invoked. Establish a mechanism that clearly indicates when permissions such as contacts, microphone, camera, location and clipboard are in use, so that users know the status of personal information collection promptly and accurately.
12. Improve app risk early-warning capabilities. Promote electronic signature authentication of apps and give users early-warning alerts, improving the ability to identify risky apps such as counterfeit, harmful and non-compliant apps.
(V) Consolidate the responsibility of network access enterprises
13. Register information accurately. When providing network access services for apps and SDKs, register and verify information such as the true identity and contact details of the developers and operators of those apps and SDKs, improving traceability.
14. Ensure effective disposition. As required by the telecommunications regulatory authorities, take necessary measures such as cutting off access against non-compliant apps and SDKs in accordance with the law, effectively stopping their non-compliant conduct that infringes user rights.
III. Work Requirements
(I) Ensure organization and implementation. All units shall adhere to the people-centered development philosophy, raise their political standing, strengthen their sense of responsibility, break tasks down in detail, and conscientiously implement this Notice to ensure that real results are achieved. Relevant enterprises shall fulfill their primary responsibility, carry out self-inspection and self-correction against the requirements of this Notice, and effectively safeguard users’ lawful rights and interests. At the same time, they shall improve long-term mechanisms, innovate models and methods, continuously raise the level of mobile internet application services, and continuously strengthen users’ sense of gain, happiness and security.
(II) Strengthen guidance and supervision. The Ministry of Industry and Information Technology will improve its testing and evaluation, notification, ranking and public-disclosure mechanisms, advance this work in a solid and orderly way, and promptly summarize and promote outstanding cases and good practices. Communications administrations in all localities shall strengthen supervision and inspection, and guide and urge enterprises within their jurisdictions to implement every requirement of this Notice. Where implementation is inadequate or non-compliant conduct occurs, measures such as ordering rectification within a time limit, public announcement and organizing removal from app stores shall be taken in accordance with the law, and accountability shall be strictly pursued and violations investigated and dealt with.
(III) Strengthen the use of technology. The China Academy of Information and Communications Technology shall organize industry forces, make comprehensive use of new technologies and means such as artificial intelligence and big data, upgrade and build a national public service platform for the testing and certification of mobile internet applications, continuously improve the platform’s functions, and do its technical testing, monitoring services and regulatory support well. Traceable technical means such as electronic signature authentication shall be actively promoted and applied, to help improve service management capabilities.
(IV) Promote industry self-regulation. Industry associations and relevant institutions are encouraged to formulate industry self-regulatory conventions, technical standards and service specifications, and to strengthen assessment and certification and talent development. Channels for listening to the views of the public shall be further opened, exchanges and interaction among all parties promoted, and enterprises guided to operate lawfully and in compliance and to keep optimizing and improving their services, creating a sound environment of striving for excellence and mutual advancement and promoting high-quality development through high-quality services.
Ministry of Industry and Information Technology
February 6, 2023
How MIIT’s public-naming bulletins use this Notice
MIIT’s bulletins on apps (SDKs) infringing user rights cite no article for any finding. Some of their finding categories fall outside personal-information law altogether (auto-renewal, misleading downloads). Others are spelled out here in more detail than in the PIPL or the Telecom & Internet User PI Provisions (app information on distribution platforms, SDK disclosure). DCC reads those categories against this Notice. The bulletins do not cite it, so the mapping below is DCC’s reading, not MIIT’s.
| Bulletin finding category | Provision | What the Notice asks |
|---|---|---|
| 违规提供自动续费服务 — non-compliant provision of auto-renewal services | Part I, item 7 | The user’s consent; no pre-ticked boxes or forced bundling; a reminder five days before renewal; easy cancellation |
| 欺骗误导用户下载APP — deceiving or misleading users into downloading apps | Part I, item 1 | No bait-and-switch, forced bundling or silent download; developer, functions, privacy policy and permissions shown before download |
| APP信息明示 — display of app information | Part II, item 4 | The distribution platform displays each listed app’s name and functions, developer and operator, version, permissions and their purposes, and processing rules |
| SDK信息公示 — public disclosure of SDK information | Part II, item 7 | The SDK provider discloses the SDK’s name, developer, version, main functions, instructions for use and processing rules |
Other recurring categories also have a counterpart here: information windows (Part I, item 4), self-start and associated start (Part I, item 6), and permission requests (Part I, item 10). DCC’s briefs on 2026 Batch 5 and 2026 Batch 6 cite the Notice for the four categories in the table.
In Chinese terms the Notice is a normative document (规范性文件) issued in letter form (函), not a departmental rule (部门规章) made by ministerial order. DCC files it under rules, as it does MIIT’s other notices. It has no penalty clause of its own. It names the PIPL, the Telecommunications Regulations, the Several Provisions on Regulating the Market Order of Internet Information Services, and the Telecom & Internet User PI Provisions as its basis. Part III(II) lists the measures the communications administrations take: orders to rectify within a time limit, public announcement, and removal from app stores.
Part II is organized by actor, which makes it a useful checklist for anyone in the chain. Items 1–3 bind app developers and operators. Items 4–6 bind distribution platforms, and the CAC’s Mobile App Information Services Provisions impose parallel listing-review duties on them. Items 7–9 bind SDK providers. Items 10–12 address the device side without naming a subject. Items 13–14 bind network access providers.
Source: www.gov.cn (State Council policy document library; source: MIIT website)