MIIT Public-Naming Bulletin 2026 Batch 5 (Total Batch 58): 26 Apps and SDKs Named, With Auto-Renewal, Misleading Downloads, and Non-Compliant Use in the Findings

Editor’s Note — DCC.

This fills the gap in DCC’s enforcement tracker between Batch 4 (32 apps, July 2026) and Batch 6 (17 apps and SDKs, October 2026): the Notification on Apps (SDKs) Infringing User Rights (2026 Batch 5, Total Batch 58) (关于侵害用户权益行为的APP（SDK）通报（2026年第5批，总第58批）), issued by the MIIT Information and Communications Administration Bureau on August 25, 2026.

The bulletin is translated in full below. DCC worked from the copy on MIIT’s website rather than the WeChat post. There the 26-entry annex is a PDF with a text layer, so the list below is taken from the official file’s text and checked against the rendered pages, not transcribed from an image. DCC has added unofficial English renderings of app and company names for identification. The renderings are not official, and the Chinese original is authoritative.

The bulletin in full

Notification on Apps (SDKs) Infringing User Rights

(2026 Batch 5, Total Batch 58)

Pursuant to the Announcement on Carrying Out the 2026 Personal Information Protection Series of Special Campaigns, jointly issued by the Office of the Central Cyberspace Affairs Commission, the Ministry of Industry and Information Technology, and the Ministry of Public Security, and in accordance with laws and regulations including the Personal Information Protection Law, the Cybersecurity Law, the Telecommunications Regulations, and the Provisions on Protecting the Personal Information of Telecommunications and Internet Users, our Ministry has been addressing the illegal or excessive collection and use of personal information by apps and SDKs, among other problems. Recently, through spot checks carried out by third-party testing institutions it organized, our Ministry found 26 apps and SDKs engaged in conduct infringing user rights (see the Annex). They are hereby named in this notification.

The above apps and SDKs shall rectify in accordance with the relevant provisions. Where rectification is not implemented in place, our Ministry will organize the relevant disposition measures in accordance with law and regulation.

Annex: List of Apps (SDKs) with Problems Notified by the Ministry of Industry and Information Technology

MIIT Information and Communications Administration Bureau

August 25, 2026

The legal architecture matches the rest of the 2026 series: the joint 2026 campaign as authority, four instruments as the legal basis, third-party testing, then the rectify-or-face-disposition pathway. As DCC’s Shanghai takedown brief showed, that pathway ends in removal from distribution for operators who miss the rectification window.

The findings: 48 across eleven categories

The annex cites 48 findings against the 26 entries. Thirteen entries drew two findings, nine drew one, three drew three, and one, 乡村小农院, drew four.

* Eight apps, plus one SDK (旺脉 SDK) cited for the same conduct without the “APP” prefix (强制、频繁、过度索取权限).

Four categories here are absent from Batch 4, the last earlier batch whose full list DCC has tabled. Two of them go beyond personal information altogether:

• Non-compliant auto-renewal (红袖读书, an online-reading app). It is the only finding against that app, and it is not a personal-information finding. Editor’s context: MIIT’s 2023 Notice on Further Improving Mobile Internet Application Service Capabilities (工信部信管函〔2023〕26号) requires services offered on auto-renewal or auto-subscription terms to obtain the user’s consent, and bars pre-ticked boxes and forced bundling at sign-up. The bulletin does not say which requirement the app missed.
• Deceiving or misleading users into downloading an app (开心合合乐, sampled from Kuaishou). Editor’s context: the same 2023 Notice bars deceiving or misleading users into downloading or installing apps through bait-and-switch (偷梁换柱), forced bundling, or silent downloads. The bulletin does not say which method was found.
• Non-compliant use, not only collection (eight entries). Batch 4 charged collection only. Two entries here, 洋葱学园 and 秘密空间, drew a use finding with no collection finding beside it. The bulletin does not say what the use was. Batch 6 cited the same category twice.
• Forcing users to accept targeted push (足球比分, a vivo-store app, and 宁小夏有礼, a WeChat mini-program). The bulletin cites no article for any finding. The closest statutory hook is PIPL Article 24(2): where information push or commercial marketing is directed at individuals through automated decision-making, the personal information handler must also offer an option not targeting their personal characteristics, or a convenient way to refuse. Batch 6 then entered the same finding against two mattress brands’ mini-programs.

The series title says user rights, not personal information. This batch shows the difference. The auto-renewal and download findings, like the information-window findings, test how an app treats its users, not what data it takes.

Who got named: the 26

Twenty-two apps, one WeChat mini-program, and three SDKs. The profile leans to education and everyday tools: seven education or study apps, three translation and subtitle tools, two music apps, a medical-reference app, a driver’s-license points app, a football-score app, an online-reading app, a city news app, and a mini-program run by a Ningxia health-industry company. The annex gives only names, so for the rest (乡村小农院, 开心合合乐, 秘密空间, List, 国琴网) the function is not stated.

Patterns worth logging in the tracker:

• Education is the largest group. Seven entries are education or study apps. They include two gaokao application planners (高考优填报志愿, 高考志愿手册), a K-12 synchronized-classroom app (小初高同步课堂), and 洋葱学园 (Onion Academy), a widely used K-12 learning app, cited for non-compliant use. The bulletin cites no minors-specific rule and does not say whether children’s data was involved. Editor’s context: where an app processes the personal information of children under 14, PIPL treats it as sensitive personal information (Article 28) and requires guardian consent and dedicated processing rules (Article 31).
• A public-sector operator. 通视界 is run by the Tonghua municipal integrated media center (通化市融媒体中心), which the annex identifies with the Tonghua Daily and Tonghua Radio and Television. A city-run media outlet in Jilin is tested and named on the same footing as a private developer: non-compliant collection, plus forced or excessive permission requests.
• Recognizable names. 星海弹弹 is published by 北京星海钢琴集团有限公司 (Beijing Xinghai Piano Group), the piano maker. 红袖读书 comes from 北京红袖添香科技发展有限公司, the company behind the long-running 红袖添香 online-fiction brand. 医口袋 is published by 杏树林 (Xingshulin), a medical-information company.
• Mostly app stores, little super-app sampling. Twenty of the 26 came from app stores: OPPO ×7, vivo ×4, Wandoujia ×3, 360 Mobile Assistant ×2, and one each from Honor, Samsung, Baidu, and the Apple App Store. Only three were sampled inside super-apps (two Kuaishou listings and one WeChat mini-program). Batch 6 reversed that: eight of its 17 came from inside super-apps.
• Information windows, again from Android stores. Three entries drew an unclosable-window finding (one vivo, two OPPO), and one of them, 高考优填报志愿, also drew a click-redirect finding.
• The SDK findings travel downstream. 聚推广告 SDK-Android is an ad SDK by its own name, cited for collection beyond the scope. 相芯科技 AR 视频特效 SDK (an AR video-effects SDK) drew three findings: non-compliant and beyond-scope collection, plus inadequate SDK information disclosure. 旺脉 SDK drew forced or excessive permission requests plus the same disclosure finding. With Batches 4 and 6, the SDK-disclosure finding has now appeared in three batches running.

Taken from the text of the PDF annex attached to the bulletin on MIIT’s website and checked against the rendered pages; the original is authoritative. ”—” marks the entry the bulletin lists without a version (”/”). Entry 25’s version is printed as a range (“6.5.0-3.7.0”) and is reproduced as given. English renderings of app and company names are DCC’s unofficial translations or transliterations, provided for identification only. They are not official names, may be inaccurate, and may differ from an operator’s registered English name. The Chinese names are the operative identifiers.

What overseas compliance teams should take from it

• “User rights” is wider than personal information. Two findings here, auto-renewal and a misleading download, are not data findings at all. Subscription sign-up and install flows are tested alongside the privacy policy. Auto-renewal should be an affirmative choice, never a pre-ticked box or a bundle.
• What you do with the data is now charged, not only what you take. Eight entries drew non-compliant use, two of them with no collection finding beside it. A clean collection record does not settle the question.
• Education apps draw the regulator’s attention. Seven of the 26 are education or study apps. Where a product reaches children under 14, PIPL’s sensitive-information and guardian-consent rules sit on top of everything the bulletin tests.
• Personalized push needs an off switch, in a football-score app as in a WeChat mini-program. If a product pushes content based on a user’s profile, it should also offer a non-personalized option or an easy way to refuse.
• Run the SDK inventory again. All three SDKs drew collection or permission findings, and two were cited for not publishing their own information. A finding against an SDK you embed is a finding about your app’s behavior.
• The cadence is holding. Batch 5 landed in late August, between Batch 4 in early July and Batch 6 in mid-October. The rectify-then-dispose pathway behind it is unchanged.

— 工业和信息化部信息通信管理局 (MIIT Information and Communications Administration Bureau), 关于侵害用户权益行为的APP（SDK）通报（2026年第5批，总第58批） (Notification on Apps (SDKs) Infringing User Rights (2026 Batch 5, Total Batch 58)), August 25, 2026, published on the MIIT website. Original (Chinese). Annex (PDF).

The 26-entry list was taken from the text of the PDF annex. English names in the table are DCC’s unofficial translations and may be inaccurate. The original is authoritative.

— Not legal advice.