On September 15, 2026, the Cyberspace Administration of China (CAC) published ten typical enforcement cases in the areas of cybersecurity, data security, personal information protection and artificial intelligence. Four of them concern personal information. They involve a vehicle device, a fitness application, facial recognition at business premises and cross-border transfers through desktop software.
The companies are not named, and the fine amounts are not disclosed. However, the cases indicate where local regulators focus their attention. This article reviews each case.
Security Risk as a Standalone Violation
The first case concerns a Guangdong software company that developed a hardware “box” product for vehicles. The product contained an unauthorized access vulnerability. Its console on port 4000 could be accessed through a web browser without login verification, which exposed vehicle status information. Users could also link the product to a WeChat official account. Personal information transmitted to that account, and status queries made through it, were not encrypted.
The announcement does not refer to an actual data leak. The CAC classified the matter as a personal information leakage risk. The company had failed to implement basic technical measures such as identity authentication and encryption in transit. The Personal Information Protection Law (“PIPL”) requires controllers to adopt security measures, including encryption (Article 51). The CAC also cited the Cybersecurity Law and the Network Data Security Management Regulations. The local CAC ordered the company to rectify the issues and issued a warning.
For companies offering connected products in China, the implication is that regulators may act before any breach occurs. An exposed interface may itself constitute a violation.
Bundled Permissions and the Necessity Principle
The second case concerns a common practice in mobile applications. A Zhejiang company operated a sports management app. When users activated the running feature, the app requested location, phone and storage permissions in a single step, citing the need to “prevent cheating”. Users who declined could not use the running feature.
The CAC rejected this approach. The app did not offer differentiated options for different scenarios, and alternative means of achieving the purpose were available. The CAC concluded that the company had collected and used personal information beyond what was necessary. It ordered the company to rectify the practice and issued a warning.
Fraud prevention is a legitimate objective. Under the PIPL, however, collection must be limited to the minimum scope necessary for the purpose (Article 6). A controller may not refuse to provide a product or service because an individual withholds consent, unless the processing is necessary for that product or service (Article 16). A valid justification for one permission does not extend to a bundle of permissions.
Facial Recognition for Commercial Purposes
In Chongqing, a real estate company installed more than ten image capture devices at its business premises and collected over 5,000 customer facial images. It used this data to identify customers and to match customers with intermediary agencies for marketing purposes.
The company did not inform customers of the purpose, method and use of the processing in a truthful, accurate and complete manner. It also did not obtain separate consent. The CAC cited the PIPL and the Network Data Security Management Regulations. The company was ordered to rectify the practice and received a warning and a fine.
Biometric information, which includes facial information, is sensitive personal information under the PIPL (Article 28). Its processing requires separate consent (Article 29), and individuals must be informed truthfully, accurately and completely of the purpose and method of processing (Article 17), as well as of its necessity and its impact on their rights and interests (Article 30). In this case, the stated purposes were customer identification and matching customers with intermediary agencies for marketing, both routine commercial uses. The company met neither the notice nor the consent requirement, and the CAC’s findings rest on these two failures.
Unreported Cross-Border Transfers
The final case is likely the most relevant for multinational groups. Since 2022, a Shanghai technology company had used its Windows application to collect device configuration, usage duration and system information from users of its hardware products, beyond the minimum scope necessary. It transferred this information to an overseas data center, together with the names, phone numbers, email addresses, dates of birth and passwords that users provided at registration. The company did not apply for a CAC data export security assessment.
The CAC cited the PIPL and the Provisions on Promoting and Regulating Cross-Border Data Flows and imposed a fine. Article 7 of the Provisions requires a security assessment in three situations. First, a critical information infrastructure operator transfers personal information or important data abroad. Second, any other company transfers important data abroad. Third, any other company has, since January 1 of the current year, transferred abroad personal information of 1 million or more individuals (excluding sensitive personal information) or sensitive personal information of 10,000 or more individuals. The announcement does not say which of these grounds applied, and the published facts do not allow us to tell.
Multinational groups should check whether software deployed in China transmits telemetry or account data to global servers by default, and whether the number of individuals affected is tracked.
Implications for European Groups
Taken together, the four cases share a common thread. The CAC looked at how products and systems actually handle personal information, not at what policies say on paper. For European groups with subsidiaries in China, this suggests a few questions worth asking:
- Are the company’s products and systems protected by basic technical measures, such as access controls and encryption?
- Is the personal information collected limited to what each function actually needs, and can users still access core services if they decline optional processing?
- Where sensitive personal information is processed, is specific notice provided and separate consent obtained?
- Does the company know what personal information leaves China, and whether those transfers require a filing or security assessment?
Answering these questions often means looking beyond documentation and into how products and data flows actually work. FIRST PRIVACY advises European companies on PIPL compliance for their China operations, from product reviews to cross-border transfer filings. If you would like to discuss any of these points, please feel free to contact us.
This article is for general information only and does not constitute legal advice.
No comments