Filed under consent
Every brief tagged "consent".
- § 01 · ENFORCEMENT
MPS Testing Center Names 35 Apps for Personal-Information Violations: A Finance-Heavy Batch, and 15 Takedowns From the Last One
On October 30, 2026, the National Cybersecurity Notification Center published a Ministry of Public Security notice: the MPS Computer Information System Security Product Quality Supervision and Testing Center found 35 mobile apps collecting or using personal information unlawfully. The apps were tested between August 17 and September 11, 2026. This is the first notice in the MPS app-testing series that DCC has covered, and DCC translates it in full with a consolidated table of all 35 apps. Collection and use without the user's consent accounts for 30 of the 46 findings. The other seven categories, each cited against one to seven apps, cover incomplete or inaccurate notice, unlisted third-party sharing, permissions requested without stating their purpose, forced consent to non-necessary data, collection beyond the necessary scope, no effective account cancellation, and no convenient channel to exercise rights. The batch leans heavily toward finance: by their names alone, at least ten are wealth-management, fund, brokerage, or stock-picking apps. Every app was sampled from a mainstream app store, with Apple's the largest source. The notice also reports that 15 of the previous batch's 42 apps failed retest and were taken down by distribution platforms.
- § 02 · CONSENT
One Signature, Two Documents: A Beijing Financial Court Ruling and the Case for Asking for Less Consent
A bank customer buying RMB 100,000 of savings bonds signed electronically three times; the bank applied the first signature both to the bond slip and to a 'Personal Information Authorization Letter'. The courts held the authorization was never formed, at first instance and on appeal, where the Beijing Financial Court ruled on December 30, 2024 ((2024)京74民终1694号). The bank had not drawn attention to the document, the customer did not stop to read it, and there was no sign of the separate tick-box step the letter itself required. 数据何规 (What Rules for Data) agrees with the courts' scrutiny of what the customer knew. It parts company with their reasoning, which treats PI consent as contractual mutual assent. Following Cheng Xiao and Gao Fuping, the author argues that consent under the PIPL is not a declaration of intent, and that withdrawing consent is not rescinding a contract. The practical point is the larger one: where PIPL Article 13 supplies another legal basis, such as performing the contract or a statutory obligation, don't ask for consent at all. Proper notice is then enough.
- § 03 · AI-GOVERNANCE
AI Agents and the Limits of Consent — When 'Authorisation' Stops Being One Click
Li Wenlong (科技利维坦) takes the Doubao phone assistant — an AI that 'reads your screen' and acts across apps — and asks whether the consent/authorisation mechanism that traditional data law leans on can survive the agent era. His four challenges: the app-bounded 'private' environment dissolves as data and permissions move across apps (with Nissenbaum's Contextual Integrity as the only real conceptual anchor, and far from operational); agents that *act* (not just retrieve) push informed consent past the point of failure already reached by personalised ads; purpose limitation collapses because an agent chooses its own path, means and decisions from a low-information instruction, edging into automated decision-making; and ultra vires agency shifts liability from user to platform, with China's 'hallucination case' and the Air Canada case as the only thin precedents. For overseas counsel building or advising on agentic AI in China: a map of why 'authorisation' is becoming a problem of agency, system control, liability allocation and autonomy — not a checkbox — and why transparency is now a prerequisite, not a feature.