Research across the library

Search laws, regulations, standards and guides

Suggested searches

Current priorities

2026-07-03Revised Internet Information Service Measures draft2026-06-18Network data risk assessment: draft versus final

What changed

Material differences at a glance

The final measures convert the CAC consultation proposal into a joint five-authority rule, retain the core focus on dependency, minors, personal information and security assessment, and add a fixed effective date and a more developed lifecycle-governance structure.

  • The final rule is jointly issued by five authorities rather than presented as a CAC consultation proposal.
  • The final text expressly frames safety duties across deployment, operation, upgrade and termination.
  • The final text adds a fixed effective date of 15 July 2026 and operative penalty provisions.

Source comparison

5 reviewed change records
Article / SectionPrevious TextUpdated TextTypePractical ImpactNotes
Issuing frameworkThe proposal was released by the CAC for public consultation.The final measures were jointly issued by the CAC, NDRC, MIIT, Ministry of Public Security and SAMR.~ ModifiedCompliance ownership extends across a multi-authority governance framework.Compare the publication announcements.Effective: 2026-07-15Previous sourceCurrent source
Lifecycle governanceThe draft required provider safety-management systems and safeguards.The final text expressly requires safety responsibilities across deployment, operation, upgrade and termination, together with monitoring, risk assessment and log retention.i ClarifiedProduct governance should cover the complete service lifecycle rather than launch review alone.Final Articles 9-10.Effective: 2026-07-15Current source
MinorsThe draft addressed guardian consent, minors' data and protective settings.The final rule expressly prohibits virtual-relative and virtual-partner services for minors and requires guardian consent before other services are provided to children under 14.~ ModifiedAge assurance, mode switching and service restrictions need to be implemented together.Final Article 14.Effective: 2026-07-15Current source
User data controlsThe draft required a deletion option for historical interaction data.The final text expressly provides both copying and deletion options and restricts third-party provision of interaction data absent a legal basis or clear consent.~ ModifiedUser-facing data controls should support export as well as deletion.Final Article 16.Effective: 2026-07-15Current source
Legal status and penaltiesThe consultation draft contained no fixed commencement date.The final rule took effect on 15 July 2026 and includes an operative enforcement and penalty provision.+ AddedThe obligations now have a fixed implementation date and enforceable consequence framework.Final Articles 30 and 32.Effective: 2026-07-15Current source

Official sources

This website is for informational and educational purposes only. It does not constitute legal advice. The Chinese text shall prevail. Users should consult qualified legal counsel for specific matters.