#
AI- and biometric-specific rules are extensive and rapidly evolving (including a 2025 CSL amendment), but genetic-data specificity is absent and state-surveillance carve-outs remain structurally unconstrained by PIPL's private-sector-facing rules.
Sub-modules (6)
Profiling RestrictionsAmber
PIPL Article 24 prohibits unreasonable differential treatment via automated decision-making (e.g., algorithmic price discrimination) and requires non-targeted or opt-out marketing options.
Claims (1):
- PIPL Article 24 requires personal information processors engaging in automated-decision-making-based marketing to provide non-targeted options or simple rejection mechanisms, addressing algorithmic price discrimination and profiling-driven differential treatment.
Automated Decision Making TransparencyGreen
Individuals may request an explanation of automated-decision-making use and challenge decisions made solely by automated means where those decisions significantly affect them.
Claims (1):
- Data subjects have the right to request an explanation regarding the use of personal information in automated decision-making and to refute a decision made solely by automated means where it significantly affects them.
Ai Risk AssessmentsAmber
The amended Cybersecurity Law (passed October 2025) brings AI governance within CSL's scope and raises maximum penalties; the 2023 Interim Measures for Generative AI Services separately require security assessments for generative AI services with 'public opinion attributes.'
Claims (1):
- China's amended Cybersecurity Law, passed in October 2025, brings artificial intelligence governance within the CSL's scope and raises the maximum fine for companies to CNY50 million or 5% of the previous year's turnover, with individual penalties up to CNY1 million.
Biometric RegimeAmber
Biometric identification information is classified as sensitive personal information under PIPL Art 28, requiring separate consent, and is further governed by CAC measures on the security of facial recognition technology.
Claims (1):
- PIPL Article 28 classifies biometric identification information as sensitive personal information requiring separate consent for processing, and CAC has issued dedicated measures governing the security of facial recognition technology deployment.
Genetic DataRed
No standalone genetic-data regime distinct from PIPL's general 'medical health information' sensitive-category treatment was identified in this research pass.
State Surveillance CarveoutsRed
PIPL's consumer-facing protections do not constrain the PRC central government's own data access; independent legal commentary observed little indication of legal limits on state surveillance activity notwithstanding PIPL's commercial-sector rules.
Claims (1):
- PIPL's private-sector-facing protections do not prevent the PRC central government from accessing data, and legal commentators have observed little indication of legal limits on government surveillance or meaningful civil-society oversight mechanisms in this area.
No new data since the standing brief. 1 periodic run re-emitted it unchanged.
Sources and claims (5)
- ProbableIAPP — PIPL Article 24 requires personal information processors engaging in automated-decision-making-based marketing to provide non-targeted options or simple rejection mechanisms, addressing algorithmic price discrimination and profiling-driven differential treatment.observed
- ProbableIAPP — Data subjects have the right to request an explanation regarding the use of personal information in automated decision-making and to refute a decision made solely by automated means where it significantly affects them.observed
- ProbableIAPP — China's amended Cybersecurity Law, passed in October 2025, brings artificial intelligence governance within the CSL's scope and raises the maximum fine for companies to CNY50 million or 5% of the previous year's turnover, with individual penalties up to CNY1 million.observed
- ProbableOneTrust DataGuidance — PIPL Article 28 classifies biometric identification information as sensitive personal information requiring separate consent for processing, and CAC has issued dedicated measures governing the security of facial recognition technology deployment.observed
- ProbableIAPP — PIPL's private-sector-facing protections do not prevent the PRC central government from accessing data, and legal commentators have observed little indication of legal limits on government surveillance or meaningful civil-society oversight mechanisms in this area.observed