Regulations in 2022 get tougher for Chinese tech companies

Are you collecting, processing, or transferring data from Chinese users as part of your business operations. If so, the rules that govern what you can do with that data changed dramatically between 2021 and 2026, and the consequences of non-compliance are serious. China’s data security and privacy laws are now among the strictest in the world, and they apply to international companies operating in China just as much as they apply to domestic tech giants. This article gives you a clear picture of where things stand in 2026 and what your company needs to do to stay on the right side of Chinese law.

The Three Laws That Changed Everything

China’s current data governance framework rests on three major pieces of legislation that came into force between 2021 and 2022:

The Personal Information Protection Law (PIPL), which came into effect in November 2021, is China’s equivalent of GDPR but with some important differences. It requires explicit consent for personal data collection, gives users the right to access and delete their data, and places strict limits on cross-border data transfers. Unlike GDPR, PIPL applies to any company worldwide that handles data of Chinese citizens, regardless of where that company is based.

The Data Security Law (DSL), effective September 2021, establishes a classification system for data based on national security risk. Data is categorized as general, important, or core, with progressively stricter handling requirements. International companies that deal with data touching Chinese industries classified as strategically sensitive (including transport, healthcare, and financial services) face the strictest requirements.

The Cybersecurity Law (CSL), originally passed in 2017 but significantly updated and enforced more aggressively since 2022, requires “critical information infrastructure” operators to store certain categories of data on servers physically located in China. It also requires security reviews for any cross-border data transfers above defined thresholds.

2024-2026 Updates: What Changed More Recently

The initial wave of legislation in 2021-2022 was followed by a series of implementing regulations and new guidelines that have made compliance requirements increasingly specific:

Cross-border data transfer rules tightened further: In 2023 and 2024, the Cyberspace Administration of China (CAC) issued detailed rules on the three mechanisms for lawful cross-border data transfer: a Standard Contract (similar to GDPR’s SCCs), a CAC Security Assessment (required for large-scale or sensitive data transfers), and a Personal Information Protection Certification. By 2026 all three mechanisms are being actively enforced, and companies that are transferring Chinese user data to servers outside China without one of these mechanisms in place are exposed to significant fines.

PIPL enforcement escalating: The CAC issued substantial fines to several major tech platforms in 2024, and enforcement extended to foreign companies in late 2024 and into 2025. International companies in hospitality, travel, and e-commerce have received compliance notices related to their data collection practices on Chinese digital platforms.

New rules on algorithmic systems: Regulations on algorithmic recommendation systems that came into full effect in 2023-2024 require platforms that use algorithms to recommend content or products to Chinese users to register those systems with regulators and give users meaningful control over recommendation settings. For brands using programmatic advertising in China, this affects how retargeting and personalized ad delivery works.

App store and mini program oversight: In 2025, MIIT extended its mobile app compliance requirements to WeChat Mini Programs and other in-app experiences. Any Mini Program that collects user data must now include a compliant privacy policy in Chinese, obtain explicit consent before data collection, and maintain audit logs. For brands building commercial WeChat Mini Programs, this is a compliance layer that cannot be skipped. For practical guidance on building a compliant WeChat presence, see our WeChat Advertising Guide.

What International Companies Operating in China Need to Do Now

If you have any digital touchpoint with Chinese consumers, whether it’s a WeChat account, a booking platform, a cross-border e-commerce store, or a website that Chinese users visit, you should take the following steps:

Data mapping: Understand exactly what personal data you collect from Chinese users, where it’s stored, how it’s used, and whether it’s transferred outside China. This is the foundation of PIPL compliance and without it you cannot assess your risk.

Privacy policy update: Your Chinese-language privacy policy needs to comply with PIPL’s specific disclosure requirements. This is more detailed than a standard GDPR-style privacy notice and needs to be written specifically for Chinese law, not translated from your Western privacy policy.

Cross-border transfer mechanism: If you’re sending any Chinese user data outside China (to your global CRM, your booking system, your marketing platform), you need one of the three approved mechanisms in place. A local Chinese legal advisor can help you identify which mechanism applies to your situation.

Consent mechanisms: PIPL requires separate, explicit consent for each purpose of data processing. Bundled consent (one tick-box that covers everything) is not compliant. Your digital properties in China need to be updated to collect consent correctly. You can also review our guide on Baidu SEO Guide for how data rules affect search marketing and tracking in China.

Key Trends to Know in 2026

• Enforcement moving from platforms to brands: Chinese regulators spent 2022-2023 largely focused on domestic tech giants. In 2024-2026 enforcement is increasingly touching mid-size international companies operating in China.
• Data localization requirements expanding: More sectors are being added to the list of industries where data must be stored in China. Travel and hospitality are under increasing scrutiny.
• AI governance adding a new layer: New AI-specific regulations from 2024-2025 require companies using AI to process Chinese user data (including AI-driven recommendations, chatbots, or content generation) to register their AI systems and conduct security assessments.
• Supply chain data compliance: International companies are now being held responsible for data practices of their Chinese distribution partners and local service providers. Contracts must include data compliance clauses.
• Data breach notification requirements: China’s data security rules now require notification of the CAC within 24 hours of a major data breach affecting Chinese users. Response plans need to be in place before incidents happen.
• Cross-border certification becoming standard: By late 2025, Standard Contracts and PIPL certifications have become a standard part of China market entry documentation for international brands.
• Consumer awareness growing: Chinese consumers in 2026 are more aware of their data rights under PIPL than they were in 2021. Brands that handle data respectfully and transparently are seeing measurable trust benefits.

What Our Expert Says

“Most international companies I work with are in one of two categories: those that don’t know about PIPL yet and those that know about it but assume it doesn’t apply to them because they’re not based in China. Both groups are wrong. PIPL is extraterritorial. If you’re collecting personal data from Chinese users for the purpose of providing them with products or services, you’re in scope. The practical first step is always the same: do a data mapping exercise, find out exactly what you’re collecting and where it’s going, and then get local legal advice on what you need to fix. The good news is that for most international brands, getting compliant is very doable. It just takes attention and the right local partners.”

Pedro Wang, founder of CTA.

How TravelSphere Rebuilt Its China Operations After PIPL

When Anna Kovacs joined TravelSphere as their Asia Pacific digital director in early 2022, the company was already in trouble in China and didn’t fully know it yet. TravelSphere was a mid-size European online travel platform that had been operating in China for four years, offering European destination packages to Chinese consumers through a Chinese-language website and a WeChat booking tool.

The platform collected significant amounts of personal data from Chinese users: names, passport details, payment information, travel preferences, browsing history. All of that data was processed on servers in the Netherlands and synchronized with TravelSphere’s global CRM platform based in Ireland. Under Chinese law this had become a problem as of November 2021, when PIPL came into force. TravelSphere didn’t have a PIPL-compliant privacy policy, didn’t have a cross-border data transfer mechanism, and didn’t have separate consent for the multiple purposes for which it was using Chinese user data.

“We had a GDPR process, and we assumed that covered us globally,” Anna recalled. “It absolutely did not.”

In March 2022, TravelSphere received a formal compliance notice from a Chinese platform partner who had become concerned about their own exposure to TravelSphere’s data handling practices. The notice was not from a regulator but it was a clear warning. Anna’s team spent the next six weeks trying to patch the issues internally, but the complexity of TravelSphere’s data infrastructure, with multiple global systems all touching Chinese user data, made it impossible to fix quickly without outside help.

They brought in a Chinese data privacy law firm and a technical partner in Shanghai. The legal assessment took three weeks and identified eleven specific compliance gaps. The most serious: the cross-border transfer of booking and payment data to European servers without a legal mechanism, and a cookie consent tool on the Chinese website that was designed for GDPR rather than PIPL.

The restructuring took eight months and cost TravelSphere approximately 180,000 euros in legal fees, technical implementation, and staff time. Key changes included: setting up a data processing sub-entity in Hong Kong to handle Chinese user data within the Greater China region, implementing a PIPL-specific consent management platform for their Chinese website, signing Standard Contracts with all third-party processors who received Chinese user data, and rewriting their Chinese privacy policy from scratch.

During the eight months of restructuring, TravelSphere paused new digital marketing campaigns in China and reduced their Chinese platform partnerships. Revenue from Chinese bookings fell by 35% during this period. It was a painful but deliberate choice: better to pause than to keep operating outside the law.

By the end of 2023 TravelSphere was fully operational again, now with a compliant infrastructure. The following year they relaunched their Chinese marketing campaigns with a specific message: “Your data, your control” (您的数据,您做主). They communicated their PIPL compliance directly to Chinese consumers as a trust signal. The response was better than expected: Chinese users in the travel category were increasingly aware of data rights, and TravelSphere’s transparency gave them a competitive edge against platforms that hadn’t yet fully addressed the issue.

By Q3 2024 Chinese bookings had recovered to pre-pause levels, and by Q1 2025 they exceeded them by 28%. More importantly, TravelSphere had built a China digital infrastructure that could scale without regulatory risk. Anna described it as “the most expensive thing we ever did, and the most necessary.”

How CTA Can Help You

CTA works with international brands to navigate the practical realities of Chinese data compliance alongside their marketing strategy. Here is what we offer in this area:

• PIPL compliance review for digital marketing activities: We assess your current WeChat, Douyin, and Baidu marketing setup and identify data collection and consent practices that need to be updated.
• Chinese privacy policy drafting: We produce PIPL-compliant privacy notices in Chinese for your website, Mini Programs, and marketing campaigns, reviewed by our local legal partners.
• Data-compliant WeChat Mini Program development: Every Mini Program we build includes correct consent mechanisms, compliant data handling, and the audit trail structure required under PIPL and MIIT rules.
• Marketing campaigns designed within compliance boundaries: We build ad targeting strategies that work within PIPL consent requirements, using compliant data sources and approved targeting methods.
• Partner network for data law specialist referrals: For complex compliance restructuring, we connect you with the right Chinese data law firms and technical partners, and coordinate between legal and marketing workstreams.
• Ongoing compliance monitoring: Chinese data rules continue to evolve in 2026. We track new regulations and update your marketing practices as requirements change.

Discover what we do at CTA’s advertising services in China.

About CTA

CTA (Greater Marketing Agency) has been helping international brands reach Chinese consumers since 2012. We work with over 500 brands across industries, and we have seen the Chinese regulatory environment change significantly over the past decade. Our Shanghai team follows regulatory updates from CAC, SAMR, MIIT, and NRTA on a daily basis. When compliance rules change, our clients are the first to know, and we adjust their marketing programs accordingly. Building your China strategy with CTA means you’re not caught off guard when the rules shift.

About the author: Claire is a Digital Marketing Specialist at CTA. She has spent 6 years working with hotels, brands and destinations to attract Chinese travelers and consumers. She writes about what actually works in the Chinese market in 2026. Want to know more? Visit our services page.

Useful Chinese Sources

QuestMobile (questmobile.com.cn) tracks how Chinese data regulations affect app usage patterns, platform compliance actions, and user behavior changes following major regulatory announcements. Their data on consent rates and user opt-out behavior under PIPL is particularly valuable for brands managing Chinese digital campaigns.

Analysys (易观分析) publishes detailed analysis of China’s technology regulatory environment, including impact assessments of PIPL, DSL, and CAC guidelines on both domestic and international companies. Their reports track enforcement actions and compliance timelines across industries.