China releases draft data rules on Saturday, requiring apps to get clear user permission

A major step forward in the nation’s efforts to regulate how internet businesses handle personal data was taken on Saturday when Chinese officials unveiled draft legislation that would require mobile applications to obtain express consent before collecting user data.

China‘s Cyberspace Administration published the proposed “Network Data Security Management Regulations,” which outline exactly how applications are permitted to collect and use user-shared content. Public comments on the draft are welcome through February 9. 

Companies must monitor third-party tools

The “minimal and necessary” requirement, as regulators refer to it, lies at the core of the new regulations. Apps will no longer be able to conceal themselves behind unclear privacy rules. Before collecting any data, businesses will need to make it clear to users what they want.

The regulations place tech companies on the hook for more than just their own software. Firms must now oversee the third-party tools they build into their apps, checking for security holes and ensuring that these outside pieces are not secretly collecting data.

The document outlines specific safeguards for “sensitive personal information.” This covers any data collected from minors as well as fingerprints and facial scans. According to these rules, applications must allow users to limit particular data rights without totally stopping them from using the program. Manufacturers of phones and dealers of apps must also examine the software they offer and notify users of programs that can jeopardize their personal information. 

Microphones and cameras only work during active use

One change will affect users immediately: the rules state that microphones and cameras can only turn on when someone is actually using them. If you are recording a voice message or taking a picture, the app can access those features. However, the second you are done, the app must cut off that access. No more microphones staying on in the background.

The timing matters. Beijing has been cracking down harder on companies that mishandle data. Recent fines against LVMH’s Dior brand in Shanghai demonstrate that authorities are serious about privacy protection. This latest draft appears designed to set one clear standard for the entire tech industry across China.

If you're reading this, you’re already ahead. Stay there with our newsletter.