Filed under cac
Every brief tagged "cac".
- § 01 · MINORS
Draft State Council Provisions on Minors' Internet Use: A Ban on Stranger Social Networking, Minors' Mode by Default Under 16, and Filing for Devices and Platforms
On September 18, 2026, the Cyberspace Administration of China (CAC) released the draft State Council Provisions on Ensuring Minors' Healthy and Safe Use of the Internet for public comment. Comments closed October 17, 2026. DCC has translated the 25 articles, the notice, and the CAC's Explanation in full. Against the 2024 Regulations on the Protection of Minors in Cyberspace, the draft adds five things. It bans online social networking with strangers for minors (except self-supporting 16- and 17-year-olds), and extends the virtual-intimacy ban from AI companions to all network services. It makes minors' mode the only way to serve under-16s with audio and video, live-streaming, games, social networking, and AI services that may affect minors' cognition. It turns minor-user identification into a stand-alone duty, with methods that include one-time facial verification and behavioral recognition. It reaches smart terminal manufacturers and app distribution platforms. And it creates a minors' mode filing system: providers that offer a minors' mode file with the provincial cyberspace administration, while platforms identified as having a very large number of minor users and a significant impact on minors file with the national cyberspace administration through the provincial office and report on their minors' mode. Fines reach 10 times illegal gains or RMB 1 million. The effective date is blank, but the year reads 2026.
- § 02 · MINORS
CAC Opens the First Identification Round for 'Article 20' Platforms: Who Must Self-Report a Large Minor Audience, and by When
On October 16, 2026, the Cyberspace Administration of China (CAC) launched the first round of identification under the Measures for Identifying Network Platform Service Providers with a Very Large Number of Minor Users and a Significant Impact on Minors (国信办发文〔2026〕2号, effective April 1, 2026). DCC translates the announcement and its work guide in full. Platforms that meet the numeric thresholds must self-assess and file within 20 working days, which on DCC's count lands in mid-November 2026. The thresholds are 10 million registered or 1 million monthly active users for minor-directed services, and 10 million registered or 1 million monthly active minor users for general-audience services. Platforms caught by a six-factor impact test are expected to file too. Paper filings go to the provincial cyberspace administration. Platforms on the final list take on the extra duties of Article 20 of the Regulations on the Protection of Minors in Cyberspace: minors-impact assessments, a minors' mode, an independent external supervisory body, platform rules, and an annual social responsibility report. For serious breaches of two of them (the impact assessment, and cutting off harmful on-platform businesses), Article 54 allows fines of up to RMB 50 million or 5% of the previous year's turnover.
- § 03 · ENFORCEMENT
CAC's 15 September 2026 Enforcement Typical Cases (执法典型案例) — Ten Cases, and the Four That Change How You Test
On 15 September 2026 the Cyberspace Administration of China (国家网信办) published ten enforcement typical cases (执法典型案例) across cybersecurity, data security and personal information protection. Six are the familiar perimeter failures — weak passwords, unpatched vulnerabilities, unauthorized-access holes, an app forcing unnecessary permissions. Four are new, and they are the ones that should change how compliance teams test: a Chongqing property company fined for running facial recognition on 5,000+ customers for marketing without separate consent, apparently the first public penalty to turn directly on PIPL Article 26; a Shanghai company fined for exporting personal information through a Windows desktop client with no data-export security assessment; a Sichuan company's WeChat mini-program ordered offline for failing to add explicit and implicit labels to AI-generated content; and a Jiangsu company warned for running two websites as an "API relay station" (API中转站) over third-party LLM APIs without a security assessment. DCC tables all ten from the CAC notice and reads the four against PIPL, the Cross-Border Data Flows Provisions, the AI Content Labeling Measures and the 2018 Security Assessment Provisions.
- § 04 · PERSONAL-INFORMATION
China Finishes the Other End of PIPL: The Draft Provisions for Large Personal Information Handlers, Read Against Order No. 25
On 7 August 2026 the CAC published the Provisions on Personal Information Protection for Large Personal Information Handlers (Draft for Comment), consolidating its September 2025 supervision-committee draft and its November 2025 large-network-platform draft into one 50-article instrument, with comments due 7 September 2026. DCC has translated the full text and reads it against CAC/MPS Order No. 25, the small-handler regime published sixteen days earlier — because the pair is the story. Three shifts matter most. The subject changes from 'large network platform' to 'large personal information handler,' and the old registered-user and monthly-active-user tests give way to a three-factor test starting at 10 million data subjects, which reaches banks, insurers, carriers, hospitals and automakers that never thought of themselves as platforms. Designation is declared rather than automatic: a qualifying handler must self-declare through its provincial CAC and the national CAC publishes a public list, which puts the burden of self-identification on the company. And the obligations that follow are structural rather than procedural — absolute domestic storage under Article 13, a nationality requirement for data center controllers under Article 14, a protection officer drawn from management with a direct reporting line to the provincial CAC, and a supervision committee that is not a committee of the board. DCC sets out the full comparison table, the designation trap, and what the newly visible middle band means for foreign-invested subsidiaries.
- § 05 · CYBERSECURITY-REVIEW
China Opens a Cybersecurity Review of Palo Alto Networks: The Micron Playbook, Now Pointed at Firewalls
On 6 August 2026 the Cybersecurity Review Office announced a cybersecurity review of Palo Alto Networks (派拓公司) products sold in China, citing the National Security Law, the Cybersecurity Law and the Cybersecurity Review Measures. DCC reads the announcement against the Measures themselves. The review is an Article 16 own-motion proceeding initiated by the working mechanism and cleared by the Central Cyberspace Affairs Commission — not the Article 5 pathway where a CIIO declares a procurement — so there is no applicant, no declared transaction, and the Article 11/14 clocks apply only by analogy. Article 21 puts cybersecurity equipment and cloud computing services squarely in scope; Article 10 supplies the risk factors that a cloud-synchronized firewall estate maps onto almost line by line. The operative question for overseas counsel is not what happens now — nothing does — but what a failed outcome would mean: CIIOs must stop procuring, and CSL Article 37/67 as amended in 2025 exposes a CIIO that keeps using un-passed products to a fine of 1× to 10× the procurement amount plus RMB 10,000–100,000 personally. Non-designated companies acquire no legal obligation at all. Based on commentary from 数据何规, checked against the official announcement and the Micron precedent.
- § 06 · PERSONAL-INFORMATION
China Writes PIPL a Small-Business Exit Ramp: The Simplified Measures for Small Personal Information Handlers
On 22 July 2026 the CAC and the Ministry of Public Security jointly issued Order No. 25, the Provisions on Simplified Personal Information Protection Measures for Small Personal Information Handlers, effective 1 September 2026. It is the first instrument to make PIPL's obligations formally proportionate: a handler processing the personal information of fewer than 100,000 people gets a three-item processing-rules template it can satisfy with a posted notice, notice discharged through those published rules alone, consent inferred from voluntary provision of necessary information, compliance audit cut to once every five years — or waived entirely if certified — and a one-page impact assessment. Article 8 lets a handler operating solely through a network platform drop its own rules, notice, audit and assessment altogether, riding on the platform's. Article 10 extends the cross-border exemption architecture to small handlers, with important data carved out. Articles 18 and 19 make no-penalty and mitigated-penalty outcomes mandatory rather than discretionary. DCC reads it for overseas counsel whose Chinese counterparties, franchisees, merchants and portfolio companies sit under the 100,000-person line — and explains why the threshold, not the relief, is the thing to watch.