Filed under mini-programs
Every brief tagged "mini-programs".
- § 01 · ENFORCEMENT
MIIT Public-Naming Bulletin 2026 Batch 6 (Total Batch 59): 17 Apps and SDKs Named, With Mini-Programs, Forced Targeted Push, and Store-Listing Disclosure in the Findings
On October 15, 2026, MIIT's Information and Communications Administration Bureau issued its sixth public-naming bulletin of 2026 (total Batch 59), citing 17 apps and SDKs for conduct infringing user rights. DCC translates the bulletin and transcribes the 17-entry image table in full. The findings run to 30 across eleven categories. Fourteen entries drew non-compliant collection of personal information. Two categories are new to the MIIT batches DCC has covered: inadequate display of app information on a distribution platform, and swipe-triggered window redirects. Two more, non-compliant use of personal information and forcing users to accept targeted push, first appeared in Batch 5. Eight of the 17 were sampled inside super-apps rather than app stores: three WeChat mattress-brand mini-programs, an Alipay mini-program, a Douyin listing, and three Kuaishou listings. Three Android SDKs, one of them an ad SDK cited for inadequate SDK information disclosure, complete the list.
- § 02 · ENFORCEMENT
CVERC Names 82 Apps for PI Violations, and 28 From Its August Batch Are Now Off the Stores
On 23 September 2026 the National Computer Virus Emergency Response Center (国家计算机病毒应急处理中心, CVERC) named 82 mobile apps whose collection and use of personal information failed its testing, carried out between 29 July and 4 September under the 2026 CAC + MIIT + MPS joint special campaign. The notice is published as text, and DCC translates it in full: twelve violation categories, 118 findings, and every app, consolidated into one table. Three things set it apart from the MIIT and CAC notices in DCC's tracker. First, a published retest loop: of the 75 apps CVERC named in August, 28 still failed on retest and have been taken down by the distribution platforms. Second, the taxonomy has moved past the 2019 Identification Method into PIPL's statutory text. Five categories track PIPL Articles 23, 24, 30, 31 and 51 almost word for word: separate consent for sharing with another handler, an opt-out from automated-decision push, notice of why sensitive personal information is needed, dedicated rules for children under 14, and security measures. Third, the perimeter: 29 mini-programs on WeChat, Baidu and Alipay, three WeChat service accounts, two TV apps, a standalone ad SDK, and twelve builds downloaded from third-party download sites. Eight hospital channels are named, among them United Family Healthcare's mini-program, and hospitals account for four of the eleven findings of sharing personal information without separate consent.
- § 03 · ENFORCEMENT
CAC Names 30 Apps and Mini-Programs for PI Violations — Nearly Half for Ineffective Account Cancellation
On June 11, 2026 the Office of the Central Cyberspace Affairs Commission published a notification naming 30 apps and mini-programs for personal-information collection and use violations, found in testing organized under the 2026 CAC + MIIT + MPS joint special campaign. The violations fall into four categories — undisclosed PI collection rules (7 apps), frequent demands for non-essential permissions (4), incomplete SDK disclosure (5), and, the dominant category at 14 of 30, failure to provide an effective account-cancellation function. DCC reads the notification as the CAC tier of the same campaign whose MIIT testing tier we covered in the Batch 56 brief: a broader perimeter that expressly includes mini-programs, a 15-working-day rectify-and-report deadline, and a clear signal that exit rights — account cancellation and deletion — are a 2026 testing priority.