Editor’s Note — DCC.
This brief translates 数据何规 (What Rules for Data)‘s commentary on a civil judgment of the Beijing Financial Court, (2024)京74民终1694号, decided December 30, 2024. The post appeared on October 20, 2026, and names no author; “I” below is the post’s author. The facts are as the author reads them from the second-instance judgment. DCC has not independently obtained the judgment text.
Two pieces of background help. First, the courts relied on Articles 14, 17, and 23 of the Personal Information Protection Law. Respectively, these cover consent that is informed, voluntary, and explicit; the content of the notice; and separate consent for providing personal information to another handler. The courts also relied on Article 134 of the Civil Code, under which a civil juristic act is formed by the parties’ mutual declarations of intent. Second, the author’s main argument rests on PIPL Article 13(2): where one of the non-consent grounds in Article 13(1)(2)–(7) applies, such as performing a contract or a statutory obligation, no consent is required. For a related argument about one-click “authorization”, see DCC’s AI Agents and the Limits of Consent.
The original title is “Fewer Pop-ups, Fewer Tick-boxes, Less Consent”.
I recently came across a judgment of the Beijing Financial Court, (2024)京74民终1694号. When a customer bought government bonds, a single electronic signature was applied both to a business slip and to a Personal Information Authorization Letter. The court ultimately held that the authorization letter was never formed.
The more important question, though, comes before any of that. Before asking a customer to sign, tick, or click “agree”, did anyone check whether the processing actually needs consent?
I. The facts and the judgment
On June 10, 2023, a customer surnamed Wang (王某某) went to a bank to buy RMB 100,000 of savings government bonds and signed electronically three times during the transaction. The bank admitted that the first signature was applied both to the Bond Business Slip and to the Personal Information Authorization Letter. The letter covered the collection, storage, use, and transmission of customer information, and the provision of information to the bond registration and custody institution.
Wang later discovered the authorization and asked the bank to revoke it. The bank refused, saying the account still held bonds and its system could not process the request. According to the second-instance judgment, Wang first sued to have the documents rescinded. At the first-instance hearing, Wang expressly asked the court to confirm that the authorization letter was never formed. Wang also asked the court to hold the bank liable for any related harm in the future.
On the evidence, including video recordings, the first-instance court found three things. The bank had not adequately drawn attention to the content of the document. Wang had not paused to read it. And there was no sign of the separate tick-box step that the letter itself required. Citing PIPL Articles 14, 17, and 23 and Civil Code Article 134, the court confirmed that the authorization letter was not formed and dismissed Wang’s other claims. Wang appealed anyway. On December 30, 2024, the Beijing Financial Court dismissed the appeal and upheld the original judgment.
II. Consent to processing is not contractual assent
Both the bank and the court may have conflated the formation of a contract with consent to the processing of personal information.
I agree with the court’s examination of what the customer knew. I have reservations about its reasoning, which judges the consent by asking whether the parties reached mutual assent. Professor Cheng Xiao (程啸) argues expressly that consent in personal information processing “is not a declaration of intent and is not a civil juristic act”. Nor do the individual and the handler reach mutual assent to create, change, or terminate a civil legal relationship. Consent to the processing should still be examined under PIPL Article 14, which asks whether it was fully informed, voluntary, and explicit. It cannot be made to depend, across the board, on the parties having reached contractual assent. So the judgment’s long discussion of whether the parties’ declarations of intent met, and of whether a contract was formed, struck me as deeply awkward. This is not a bilateral contract at all.
Rescinding a contract and withdrawing consent should also be kept apart. The appeal court said the authorization letter was never formed and so could not be rescinded. That answered Wang’s claim to rescind the documents, but the reasoning does not fully address the difference between the two. An individual can withdraw valid consent as the law allows, without having to prove a ground for rescinding a contract, such as fraud or gross misunderstanding. If valid consent was never obtained, the bank cannot rely on the signature as consent, and it cannot require the customer to “withdraw” first before the error is corrected.
Professor Gao Fuping (高富平) puts it as “consent ≠ authorization”. Obtaining consent does not give a handler freedom to use the information unconstrained by law. Consent to processing is not a blanket authorization on a piece of paper, and it cannot replace review of whether the processing itself is lawful and reasonable. What the bank really needs to sort out is which processing requires consent, what consent it actually obtained, and what happens when a customer refuses or withdraws. That is also why it is debatable whether the document in this case should have been called a “Personal Information Authorization Letter” at all. More on that below.
III. Before the pop-up, ask whether it is needed at all
My core view is this: if there is another legal basis, never use consent or separate consent. The notice can then go into the privacy policy or the contract, and you don’t have to worry about consent being withdrawn. Collecting consent indiscriminately through pop-ups and tick-boxes is unwise, commercially and for compliance.
PIPL Article 13(2) provides that in the circumstances in items (2) to (7) of Article 13(1), the individual’s consent is not required. That includes separate consent. Where the processing really is necessary to perform a contract, fulfil a statutory obligation, or the like, separate consent does not become necessary merely because sensitive personal information is involved or information is provided to another personal information handler.
I have argued this at length before, in “Can separate consent really be waived?” (单独同意真的可以被豁免). Article 22 of the Regulation on Network Data Security Management also places the separate-consent requirement for sensitive personal information under the premise of “processing based on the individual’s consent”.
In this case, the necessary processing (subscription, debiting the funds, interest payment and redemption) should first be tested against the contract-performance basis. The Administrative Measures for Savings Government Bonds (Electronic) also set requirements for business records, reconciliation of custody balances, and transmission of business data. Those provisions let you check further whether specific processing can rest on a statutory obligation.
If those bases cover every data field and every scenario, you do not need a separate authorization letter at all. Proper notice is enough. Notice can usually go into the business contract or the transaction page; it does not need to be a stand-alone document.
If you do produce a separate document and it only gives notice, I suggest calling it a Personal Information Processing Notice. If consent is genuinely needed, call it a Personal Information Processing Notice and Consent Form, and spell out the matters on which the customer has a real choice.
While I’m at it, a gripe about app and mini-program splash screens. The moment you open one, you are asked to tick the privacy policy, sensitive personal information, provision to third parties, cross-border transfer, minors, and more, and you cannot get in if you miss a single box. Splitting the matters into several boxes does not by itself mean the user has a real choice.
If a processing activity happens only when a particular feature is used, the notice and consent can usually be handled when the user turns that feature on, before processing starts. There is no need to ask, at the splash screen, for consent covering every future scenario at once.
Where the personal information of minors under 14 is involved, guardian consent and the dedicated processing rules must also be implemented. Having every user tick a children’s clause does not amount to guardian consent.
Necessary processing that by law does not rely on consent cannot be withdrawn. Processing that does rely on consent should come with a convenient way to withdraw. Tying every activity to a single “authorization” switch, and then refusing all withdrawals because the account still has a balance, creates needless conflict over problems that could have been handled separately.
Pop-ups, tick-boxes, and signatures are not free. They take up customers’ time and add friction. Combined with blanket authorizations nobody can understand, and with service cut off for anyone who refuses, they can also trigger complaints, erode trust, and even drive customers away.
Before compliance staff ask the business to add a step, they should weigh what legal problem it solves, whether it is really necessary, and what it does to customers and the business.
Privacy compliance is not done once the splash screen has popped up every option for sensitive personal information, provision to third parties, and children’s personal information.
Real problem-solving means mapping the processing activities and their legal bases first. Only then decide whether to obtain consent, when to obtain it, and which feature a refusal affects.
Where a process is legally unnecessary and also hurts the user experience, compliance staff should push to simplify it, not keep adding pop-ups and tick-boxes.
Anything else is ineffective, lazy compliance, and it deserves to be scorned.
References
- Beijing Financial Court, Civil Judgment (2024)京74民终1694号, December 30, 2024; see “the first-instance court held”, “this court holds”, and the operative part. The facts follow the second-instance judgment’s account of the first-instance proceedings and facts; this article uses the judgment’s own wording.
- Cheng Xiao (程啸), “On Individual Consent in the Processing of Personal Information” (论个人信息处理中的个人同意), Global Law Review (环球法律评论), 2021 No. 6, Part I, “The nature of individual consent”. Quoted from the text published on the journal’s WeChat account.
- Personal Information Protection Law of the People’s Republic of China, Articles 6, 13–18, 23, 28–31, 50, and 55–56. https://www.cac.gov.cn/2021-08/20/c_1631050028355286.htm
- Gao Fuping (高富平), “Consent ≠ Authorization: Analysis of the Core Issue in Personal Information Processing” (同意≠授权——个人信息处理的核心问题辨析), Exploration and Free Views (探索与争鸣), 2021 No. 4, pp. 87–94; see “The private-law effect of the information subject’s consent in China” and “Conclusion”. Quoted from the text published on WeChat.
- 数据何规, “Can Separate Consent Really Be Waived?” (单独同意真的可以被豁免).
- Regulation on Network Data Security Management, Article 22. https://app.www.gov.cn/govdata/gov/202409/30/520076/article.html
- Ministry of Finance and People’s Bank of China, Administrative Measures for Savings Government Bonds (Electronic), 财库〔2013〕7号, Articles 22, 25, 26, and 37. https://www.mof.gov.cn/gkml/caizhengwengao/wg2013/wg201302/201304/t20130415_824929.htm
- Provisions on the Scope of Necessary Personal Information for Common Types of Mobile Internet Applications, Articles 3–5. https://www.cac.gov.cn/2021-03/22/c_1617990997054277.htm
— 数据何规 (What Rules for Data), 少弹窗、少勾选、少用同意 (Fewer Pop-ups, Fewer Tick-boxes, Less Consent), October 20, 2026. Original (Chinese).
— Not legal advice.