---
title_en: "Measures for the Administration of National Network Identity Authentication Public Services"
title_zh: "国家网络身份认证公共服务管理办法"
abbreviation: "Network Identity Authentication Measures (MPS Order No. 173)"
hierarchy: "rule"
issuing_body: "Ministry of Public Security; Cyberspace Administration of China; Ministry of Civil Affairs; Ministry of Culture and Tourism; National Health Commission; National Radio and Television Administration"
adopted_date: 2025-02-27
effective_date: 2025-07-15
status: "effective"
source_url: "https://www.cac.gov.cn/2025-05/23/c_1749711107835487.htm"
related_laws: ["pipl", "csl", "dsl", "anti-telecom-fraud-law", "minors-online-protection-regulations"]
domains: ["personal-information", "data-security"]
url: https://datacompliancechina.com/laws/network-identity-authentication-measures/
summary: "MPS Order No. 173 — the departmental rule establishing China's state-run network identity authentication scheme, built on two new credentials: the 网号 ('network number'), a letters-and-digits identity symbol carrying no plaintext identity information, and the 网证 ('network credential'), which carries the network number plus the holder's non-plaintext identity data. Adopted at the 1st MPS executive meeting on 27 February 2025, promulgated 19 May 2025 with the concurrence of five other departments, effective 15 July 2025. In 16 articles it makes application voluntary for natural persons holding a valid legal identity document (with parental consent below 14), and — the provision that matters most for platforms — bars a platform that has authenticated a user through the scheme from requiring that user to supply plaintext identity information separately, while requiring equal service for users who decline it. It also confines the public-service platform to authentication-necessary data, requires separate consent for sensitive personal information, mandates domestic storage of important data and personal information with a security assessment for any outbound transfer, and routes penalties through the CSL, DSL and PIPL."
---

> **Source: Data Compliance China** — https://datacompliancechina.com/laws/network-identity-authentication-measures/ · English rendering and annotations by DCC; the Chinese original governs. Cite as: Data Compliance China, "Measures for the Administration of National Network Identity Authentication Public Services", https://datacompliancechina.com/laws/network-identity-authentication-measures/
**Promulgated by:** Ministry of Public Security, with the concurrence of the
Cyberspace Administration of China, the Ministry of Civil Affairs, the
Ministry of Culture and Tourism, the National Health Commission, and the
National Radio and Television Administration.
**Document No.:** MPS Order No. 173 (公安部令第173号).
**Adopted at the 1st Executive Meeting of the Ministry of Public Security on
27 February 2025. Promulgated 19 May 2025. Effective 15 July 2025.**
**16 articles.**

> *DCC note.* This entry is a structural summary of the Measures prepared
> from the promulgated Chinese text as published by the CAC, not a full
> translation — the article-level renderings below describe each provision
> rather than translate it. Defined terms and the operative platform
> obligations are given in the original Chinese alongside DCC's English.
> A full translation is pending.

---

## What the scheme is

The Measures establish a **state-operated identity authentication layer**
sitting between individuals and internet platforms. Rather than each
platform collecting and storing identity-document data to satisfy its
real-name verification duties, a platform can call the national public
service platform and receive a verification *result*.

Two credentials carry the scheme (Article 2):

- **网号 — "network number"**: an identity symbol corresponding to a natural
  person's identity information, composed of letters and digits, and
  containing **no plaintext identity information**
  (不含明文身份信息的网络身份符号).
- **网证 — "network credential"**: the authentication credential that carries
  the network number together with the holder's **non-plaintext** identity
  information.

The design goal is to break the link between "verifying who a user is" and
"holding the documents that prove it."

## Article map

| Art. | Subject |
|---|---|
| 1 | Purpose and legal basis — the trusted digital identity strategy, grounded in the [CSL](/laws/csl/), [DSL](/laws/dsl/) and [PIPL](/laws/pipl/) |
| 2 | Definitions — the public service, 网号, 网证 |
| 3 | Competent authorities — MPS and CAC, with the other four departments within their remits |
| 4 | Eligibility — voluntary application by holders of a valid legal identity document; parental consent required below 14, parental supervision at 14–17 |
| 5 | Use for real-name registration and verification; consent conditions for minors under 14 |
| 6 | Promotion by government bodies and key sectors, while preserving existing and alternative authentication methods — no mandatory substitution |
| 7 | **Platform integration and user parity** — see below |
| 8 | **Minimum disclosure** — the platform receives only the verification result unless document data is genuinely required |
| 9 | Limits on the public-service platform's own collection; separate consent for sensitive personal information; deletion on request |
| 10 | Age-bracket indicators may be supplied to platforms to support their minors- and elderly-protection duties |
| 11 | Notice and transparency through the user agreement — identity and contact of the operator, purpose, method, categories, retention period, and rights procedures |
| 12 | **Security management, and domestic storage** of important data and personal information; security assessment for outbound transfer; incident response and reporting |
| 13 | Commercial cryptography must comply with national cryptography administration requirements |
| 14 | Penalties — breaches of Articles 7–9, 11 and 12 are penalised under the CSL, DSL and PIPL, enforced by public security and cyberspace authorities; criminal liability where applicable; official dereliction addressed separately |
| 15 | Scope of eligible identity documents — PRC resident identity card, passports for Chinese citizens abroad, Hong Kong/Macao and Taiwan travel permits and residence permits, and foreign permanent residence identity cards |
| 16 | Effective 15 July 2025 |

## The three provisions that bind platforms

**Article 7 — no double collection, and no penalty for declining.** Where a
user has been authenticated through the network number or network
credential, the platform **must not require the user to provide plaintext
identity information separately** (不得要求用户另行提供明文身份信息), except
where a law provides otherwise or the user consents. Equally, a platform
must not degrade service for users who choose *not* to use the scheme. Both
halves matter: the first caps what an integrating platform may collect, the
second stops the scheme from becoming compulsory through commercial
pressure.

**Article 8 — verification result, not the document.** Where a platform does
not need to retain identity-document information, it receives only the
result of the check. Where document information genuinely is required, only
the minimum necessary is passed, following the user's authorisation, and the
platform may not process it beyond that purpose or disclose it onward absent
a legal requirement.

**Article 12 — localisation.** Important data and personal information
processed by the public-service platform must be stored within China
(应当在境内存储), with a security assessment required before any outbound
transfer.

## Why it matters

Article 7 is the provision to watch. Chinese law requires real-name
verification across a wide range of services, and the conventional way to
satisfy it — every platform collecting and retaining identity-document data
— produces exactly the concentration of identity records that the criminal
cases in DCC's coverage keep drawing on. The MPS's own [batch of ten typical
personal-information crime
cases](/posts/mps-ten-typical-pi-crime-cases/) leads with two rings whose
entire business was harvesting and reselling **real-name online accounts**;
that market exists only because platforms hold the underlying identity data.
A state authentication layer is the structural answer to that specific
failure mode, and the pairing of enforcement releases with promotion of the
platform is deliberate.

For overseas-invested platforms the open questions are practical rather than
doctrinal: whether integration will remain genuinely voluntary as Article 6
promises, how Article 7's bar on separate plaintext collection interacts with
KYC and anti-fraud duties under the [Anti-Telecom and Online Fraud
Law](/laws/anti-telecom-fraud-law/), and what the age-bracket disclosure in
Article 10 means for minors-protection compliance under the [Minors Online
Protection Regulations](/laws/minors-online-protection-regulations/).

---

*Source: 国家网络身份认证公共服务管理办法, 公安部令第173号, published by the
Cyberspace Administration of China, 23 May 2025.
[Original](https://www.cac.gov.cn/2025-05/23/c_1749711107835487.htm).
Summarised and annotated by DCC.*