MPS Testing Center Names 35 Apps for Personal-Information Violations: A Finance-Heavy Batch, and 15 Takedowns From the Last One

Editor’s Note — DCC.

This is the Ministry of Public Security’s tier of the 2026 app-testing campaign: a notice from the MPS Computer Information System Security Product Quality Supervision and Testing Center (公安部计算机信息系统安全产品质量监督检验中心), published by the National Cybersecurity Notification Center (国家网络安全通报中心) on October 30, 2026 and reposted the same day by 数据何规. DCC read the repost and checked it against the original post: the two match. This is the first MPS notice in DCC’s enforcement tracker. DCC did not cover the previous, 42-app batch the notice refers to.

The notice lists apps by name, version, and app store under eight finding categories, and an app can appear under more than one. DCC has translated the notice in full and consolidated the list into one table (35 apps, 46 findings). The notice gives no developer names. English renderings of app names are DCC’s unofficial transliterations or translations, for identification only; the Chinese names are the operative identifiers.

Read it alongside the other tiers of the same campaign: MIIT’s Batch 6 bulletin (October 2026) and CVERC’s 82-app notification (September 2026).

The notice in full

The MPS Computer Information System Security Product Quality Supervision and Testing Center finds 35 mobile apps collecting and using personal information unlawfully

Pursuant to the Announcement on Carrying Out the 2026 Personal Information Protection Series of Special Campaigns, jointly issued by the Office of the Central Cyberspace Affairs Commission, the Ministry of Industry and Information Technology, and the Ministry of Public Security, and in accordance with the Cybersecurity Law, the Personal Information Protection Law, the Regulation on Network Data Security Management, the Method for Identifying the Unlawful Collection and Use of Personal Information by Apps, and other laws, regulations, and relevant provisions, testing by the MPS Computer Information System Security Product Quality Supervision and Testing Center found that 35 mobile apps engaged in one or more forms of illegal or excessive collection and use of personal information. They are hereby notified as follows.

1. Collecting and using personal information without the user’s consent. 30 apps: 360你财富 (v5.0.5, Apple App Store); IT桔子 (v8.0.3.4, Huawei AppGallery); 单读 (v2.8.4, Xiaomi App Store); 荣大智慧云 (v3.4.9, Xiaomi App Store); 肝胆相照 (v3.9.9, Huawei AppGallery); 金联创 (v5.56, Huawei AppGallery); 天相财富 (v2.3.0, 360 Mobile Assistant); 诊股宝 (v1.3.1, Apple App Store); 爱租机 (v10.4.2, Xiaomi App Store); 进门 (v5.2.0800, Apple App Store); 大阳智投 (v6.0.360, Apple App Store); 安信基金 (v3.1.36, Tencent Yingyongbao); 合创汽车 (v3.39.6, Xiaomi App Store); Mini记账 (v2.4.1, OPPO App Store); 华创证券e智通 (v5.10.2, OPPO App Store); 海文交 (v3.2.5, Apple App Store); 爱记账 (v1.1.5, Huawei AppGallery); 三一卡车 (v7.09.31, vivo App Store); 全球加盟网 (v1.9.7, Apple App Store); 好买基金 (v9.2.8, Apple App Store); 东方赢家 (v6.3.0, Xiaomi App Store); 选股魔方 (v3.4.07, Apple App Store); 头号理财 (v3.8.4, Apple App Store); 五星智投 (v1.32.1, Baidu Mobile Assistant); 查个码 (v2.2.9, Huawei AppGallery); 每市 (v5.8.8, Apple App Store); 安盈智汇 (v1.0.3, Tencent Yingyongbao); 正大猪博士 (v6.17.8, Tencent Yingyongbao); 新能源云 (V2.8.2, Tencent Yingyongbao); 快期 (v1.113.30, vivo App Store).

2. Not fully and accurately informing users of the collection and use of personal information, or informing them of purposes, methods, or scope inconsistent with actual collection and use. 1 app: IT桔子 (v8.0.3.4, Huawei AppGallery).

3. Not listing the types, purposes, and methods of providing personal information to third parties, or the names and contact details of the recipients. 4 apps: 信美相互 (v4.4.14, Xiaomi App Store); 海文交 (v3.2.5, Apple App Store); 正大猪博士 (v6.17.8, Tencent Yingyongbao); 快期 (v1.113.30, vivo App Store).

4. Not informing the user of the purpose at the same time as requesting a permission that can collect personal information, or requesting sensitive personal information. 7 apps: 天相财富 (v2.3.0, 360 Mobile Assistant); 信美相互 (v4.4.14, Xiaomi App Store); 化纤圈 (v1.3.5, OPPO App Store); 安盈智汇 (v1.0.3, Tencent Yingyongbao); 中国黄金 (v1.13, Tencent Yingyongbao); 纱线圈 (v1.4.4, Tencent Yingyongbao); 国景 (v5.0.7, vivo App Store).

5. Forcing users to consent to the collection of non-necessary personal information. 1 app: 肝胆相照 (v3.9.9, Huawei AppGallery).

6. Collecting and using personal information beyond the necessary scope, collecting location, contacts, text messages, and other personal information in unrelated scenarios. 1 app: 荣大智慧云 (v3.4.9, Xiaomi App Store).

7. No effective account-cancellation function. 1 app: 选股魔方 (v3.4.07, Apple App Store).

8. No convenient channel for users to exercise rights such as correction, deletion, and refusal of processing, with the relevant functions incomplete or inadequate. 1 app: 三一卡车 (v7.09.31, vivo App Store).

Of the 42 apps found by the MPS Computer Information System Security Product Quality Supervision and Testing Center and notified in the previous issue, 15 still had problems on retest, and the relevant mobile app distribution platforms have taken them down.

(Note: the apps listed above were tested between August 17 and September 11, 2026.)

What the batch shows

Consent is the headline finding. Thirty of the 35 apps were cited for collecting and using personal information without the user’s consent. That is 30 of 46 findings, under the third of the six categories in the 2019 Identification Method. The other seven categories are each cited against one to seven apps, and map onto the Method’s other categories: notice that is incomplete or does not match practice, undisclosed third-party sharing, permission requests without a stated purpose, forced bundling of non-necessary data, over-collection in unrelated scenarios, account cancellation, and data-subject rights channels.

It is a finance-heavy batch. By their names alone, at least ten of the 35 are wealth-management, fund, brokerage, or stock-picking apps (for example 360你财富, 安信基金, 好买基金, 华创证券e智通, 头号理财, 选股魔方, and 诊股宝). Several more, including a futures-trading app (快期) and a mutual insurer’s app (信美相互), sit in the same sector. The rest are a mix: bookkeeping apps, an EV maker’s app (合创汽车), a truck maker’s app (三一卡车), commodity-trading communities for chemical fiber and yarn, a liver-health app, and a livestock-farming app (正大猪博士).

All from app stores. Every app was sampled from a mainstream store: Apple’s App Store (10), Xiaomi (6), Tencent Yingyongbao (6), Huawei (5), OPPO (3), vivo (3), 360 (1), and Baidu (1). Unlike MIIT’s October batch, there are no mini-programs or super-app listings.

Eleven apps drew two findings. Most pair the consent finding with a second: 天相财富 and 安盈智汇 with purpose-at-permission; 海文交, 正大猪博士, and 快期 with unlisted third-party sharing; IT桔子 with inaccurate notice; 荣大智慧云 with over-collection; 肝胆相照 with forced consent; 选股魔方 with account cancellation; 三一卡车 with rights channels. 信美相互 is the one app cited twice without the consent finding: unlisted third-party sharing and purpose-at-permission.

The retest loop bites. As in CVERC’s series, the notice closes on the previous batch: 15 of its 42 apps failed retest and have been taken down by distribution platforms. The notice names neither the 15 nor a rectification deadline for this batch.

The 35 apps

Findings key: 1 = collection and use without consent; 2 = incomplete or inaccurate notice; 3 = third-party sharing not listed; 4 = purpose not given when requesting a permission or sensitive personal information; 5 = forced consent to non-necessary personal information; 6 = collection beyond the necessary scope in unrelated scenarios; 7 = no effective account cancellation; 8 = no convenient channel to exercise rights. Order follows the notice. English renderings are DCC’s unofficial transliterations or translations, for identification only, and may differ from an operator’s registered English name.

What overseas compliance teams should take from it

• A third tester, the same checklist. MIIT, CAC, CVERC, and now the MPS testing center are all testing apps under the same 2026 campaign. The MPS findings follow the 2019 Identification Method closely, so the Method remains the most practical self-assessment checklist for a China-facing app.
• Consent flows are where apps fail. Thirty of 35 apps were cited for collecting or using data without consent. Test what the app actually collects before the user agrees, including what SDKs collect at first launch.
• Financial apps are in the frame. For brokerages, fund distributors, and wealth platforms with a China app, this batch is a direct signal. Whatever sector rules also apply, the PIPL baseline does too, and the police tier of the campaign is testing for it.
• Say why you are asking. Seven apps were cited for requesting a permission or sensitive personal information without stating the purpose at the same moment. The fix is in the permission flow, not the privacy policy.
• Retest failures end in takedown. More than a third of the previous batch (15 of 42) failed retest and were removed by the app stores.

— 公安部计算机信息系统安全产品质量监督检验中心 (MPS Computer Information System Security Product Quality Supervision and Testing Center), 公安部计算机信息系统安全产品质量监督检验中心检测发现35款违法违规收集使用个人信息的移动应用 (The MPS Computer Information System Security Product Quality Supervision and Testing Center Finds 35 Mobile Apps Collecting and Using Personal Information Unlawfully), published by 国家网络安全通报中心, October 30, 2026. Original (Chinese). Read via the 数据何规 repost.

English app names are DCC’s unofficial renderings and may be inaccurate. The Chinese original is authoritative.

— Not legal advice.