Cybersecurity Policy Report, Violations of Chinese Privacy Law Identified in 33 Apps, (Apr 28, 2026)

By Tony Foley

In a notification published yesterday, the Cyberspace Administration of China (CAC) said it found violations of China’s Personal Information Protection Law (PIPL) against 33 web applications.

The notification said the CAC, in conjunction with the Ministry of Industry and Information Technology and the Ministry of Public Security, organized a detection investigation of the collection and use of personal information by the apps at issue. The investigation found various violations of the PIPL, including the following:

1. Fifteen apps either lacked rules for collecting and using personal data or failed to clearly prompt users to read the rules for collecting and using personal information through pop-up or other obvious means when running the app for the first time;

2. Two apps failed to list the software development kits that collect and use personal information and did not obtain user consent;

3. Four apps violated the principle of necessity by collecting personal information unrelated to the services provided; and

4. Twelve apps failed to provide an effective way to cancel accounts or set unreasonable conditions for users to cancel their accounts.

CAC said the apps would have to fix their violations within 15 working days from the date of the notification and to report status to CAC. The agency will conduct verification in conjunction with relevant departments and take appropriate action and impose penalties in accordance with law and regulation based on the results of the reported rectifications.

News: InternationalLegislation LitigationEnforcement DataPrivacy