MIIT Public-Naming Bulletin 2026 Batch 6 (Total Batch 59): 17 Apps and SDKs Named, With Mini-Programs, Forced Targeted Push, and Store-Listing Disclosure in the Findings

Editor’s Note — DCC.

This is the next entry in DCC’s enforcement tracker: the Notification on Apps (SDKs) Infringing User Rights (2026 Batch 6, Total Batch 59) (关于侵害用户权益行为的APP（SDK）通报（2026年第6批，总第59批）), issued by the MIIT Information and Communications Administration Bureau on October 15, 2026 and published on 工信微报 under the headline 速自查！这17款APP及SDK存在侵害用户权益行为 (“Check yourself now: these 17 apps and SDKs infringe user rights”).

The bulletin is translated in full below. Its 17-entry list is attached as an image table. DCC has transcribed it (app name, developer, distribution source, version, cited issues) and added unofficial English renderings of app and company names for identification. The transcription may contain minor errors and the renderings are not official. The Chinese original is authoritative.

Read it against the series: Batch 4 (32 apps, July 2026), Batch 3 (31 apps, May 2026), and the parallel CVERC notification naming 82 apps (September 2026). The bulletin before this one is Batch 5 (26 apps and SDKs, August 2026).

The bulletin in full

Notification on Apps (SDKs) Infringing User Rights

(2026 Batch 6, Total Batch 59)

Pursuant to the Announcement on Carrying Out the 2026 Personal Information Protection Series of Special Campaigns, jointly issued by the Office of the Central Cyberspace Affairs Commission, the Ministry of Industry and Information Technology, and the Ministry of Public Security, and in accordance with laws and regulations including the Personal Information Protection Law, the Cybersecurity Law, the Telecommunications Regulations, and the Provisions on Protecting the Personal Information of Telecommunications and Internet Users, our Ministry has been addressing the illegal or excessive collection and use of personal information by apps and SDKs, among other problems. Recently, through spot checks carried out by third-party testing institutions it organized, our Ministry found 17 apps and SDKs engaged in conduct infringing user rights (see the Annex). They are hereby named in this notification.

The above apps and SDKs shall rectify in accordance with the relevant provisions. Where rectification is not implemented in place, our Ministry will organize the relevant disposition measures in accordance with law and regulation.

Annex: List of Apps (SDKs) with Problems Notified by the Ministry of Industry and Information Technology

MIIT Information and Communications Administration Bureau

October 15, 2026

The legal architecture is the same as in Batches 3 and 4: the joint 2026 campaign as authority, four instruments as the legal basis, third-party testing, then the rectify-or-face-disposition pathway. As DCC’s Shanghai takedown brief showed, that pathway ends in removal from distribution for operators who miss the rectification window.

The findings: 30 across eleven categories

The annex cites 30 findings against the 17 entries. Most entries drew two.

Four of these categories did not appear in Batches 3 and 4. Two of them, non-compliant use and forced targeted push, had already surfaced in Batch 5 in August:

• Non-compliant use, not only collection (租号真香, 小猫快玩). Batches 3 and 4 charged collection only. These two findings reach what an operator does with the data after it has it. The bulletin does not say what the use was.
• Forcing users to accept targeted push (火柴棍床垫, 美立眠床垫, both WeChat mini-programs run by mattress brands). The bulletin cites no article for any finding. The closest statutory hook is PIPL Article 24(2): where information push or commercial marketing is directed at individuals through automated decision-making, the personal information handler must also offer an option not targeting their personal characteristics, or a convenient way to refuse. CVERC’s September notification tested the same opt-out.
• App information not properly displayed on the distribution platform (66小鸭鸭, sampled from Douyin). Editor’s context: MIIT’s 2023 Notice on Further Improving Mobile Internet Application Service Capabilities (工信部信管函〔2023〕26号) asks app distribution channels to publicly display each listed app’s name and function, developer, version, required permissions and their purposes, and personal information processing rules. Here the finding is entered against the app, not against Douyin.
• Swipe-triggered redirects (360相机). Earlier batches cited click-triggered redirects; this one cites a window that jumps elsewhere when the user swipes it. The click variant also appears, against an SDK.

The SDK-disclosure finding returns from Batch 4. The same 2023 Notice asks SDK providers to publicly disclose each SDK’s name, developer, version, main functions, and personal information processing rules.

Who got named: the 17

Fourteen apps and mini-programs, plus three Android SDKs. The profile is consumer long tail: utility tools (a TV-streaming app, a call-log lookup, a camera, a drawing app), two account-rental apps, a decision-wheel app, three mattress brands’ WeChat stores, a card-collection mini-program on Alipay, and a Douyin listing.

Patterns worth logging in the tracker:

• Super-apps are now the main sampling channel. Eight of the 17 entries were sampled inside super-apps rather than app stores: three WeChat mini-programs, one Alipay mini-program, one Douyin listing, and three Kuaishou listings. Alipay and Douyin appear as sources for the first time in the MIIT batches DCC has covered. Six entries came from Android stores (OPPO ×3, Xiaomi, Wandoujia, Samsung), and the three SDKs from their developers’ official websites. No Apple App Store entry appears in this batch, against six in Batch 4.
• Consumer brands, not only app developers. The three mattress mini-programs (斯丽比迪, 火柴棍, 美立眠) are run by furniture and home-furnishing companies. A brand that sells through a WeChat store is a tested operator in its own right.
• One recognizable name. 爱玛出行 is published by 爱玛科技集团股份有限公司 (Aima Technology Group), the electric two-wheeler maker. It was cited for non-compliant collection and frequent self-start and associated start. By contrast, 360相机 is published by a Chengdu company, 成都智合华盛科技有限公司; the bulletin does not name 360 Group, and the shared name should not be read as a link.
• Information windows are back. Five entries drew a window finding: three that cannot be closed, one swipe redirect, one click redirect. All three entries cited for an unclosable window came from the OPPO store.
• The SDK findings travel downstream. The click-redirect finding against 元气 SDK is a finding about behavior that ships inside every host app embedding it. 萤火虫广告 SDK (an ad SDK) drew collection beyond the scope plus inadequate SDK information disclosure, the same pairing Batch 4 cited against 闪登 SDK. 引力引擎 SDK drew non-compliant and beyond-scope collection.

Transcribed from the image table attached to the original bulletin; the original is authoritative. ”—” marks entries the bulletin lists without a version (”/”). English renderings of app and company names are DCC’s unofficial translations or transliterations, provided for identification only. They are not official names, may be inaccurate, and may differ from an operator’s registered English name. The Chinese names are the operative identifiers.

What overseas compliance teams should take from it

• A mini-program is an app for enforcement purposes. A brand that sells to Chinese consumers through a WeChat, Alipay, or Douyin storefront is tested and named on the same footing as an app developer. That storefront belongs in the same PI review as any standalone app.
• Personalized push needs an off switch. The two targeted-push findings were entered against consumer-brand storefronts, not ad-tech firms. If a storefront pushes marketing based on a user’s profile, it should also offer a non-personalized option or an easy way to refuse.
• The store listing is part of compliance. The distribution-platform finding means the information shown on the listing (developer, version, permissions and their purposes, processing rules) is tested alongside the binary. Check that what the listing says matches what the app does.
• Run the SDK inventory again. One of the three SDKs is an advertising SDK by its own name, and another was cited for a redirecting window. A finding against an SDK you embed is a finding about your app’s behavior.
• The cadence is holding. Batch 6 lands in mid-October, after Batch 3 in late May, Batch 4 in early July, and Batch 5 in late August: 59 batches since the series began. The rectify-then-dispose pathway behind it is unchanged.

— 工业和信息化部信息通信管理局 (MIIT Information and Communications Administration Bureau), 关于侵害用户权益行为的APP（SDK）通报（2026年第6批，总第59批） (Notification on Apps (SDKs) Infringing User Rights (2026 Batch 6, Total Batch 59)), October 15, 2026, published via 工信微报. Original (Chinese).

The 17-entry list was transcribed from the image table attached to the original bulletin and may contain minor transcription errors. English names in the table are DCC’s unofficial translations and may be inaccurate. The original is authoritative.

— Not legal advice.