每周数据法律资讯 Data Law Weekly（20251222—20251228）

1. 国家网信办发布《人工智能拟人化互动服务管理暂行办法（征求意见稿）》

12月27日，国家网信办发布《人工智能拟人化互动服务管理暂行办法（征求意见稿）》。《暂行办法》适用于利用人工智能技术，向中华人民共和国境内公众提供模拟人类人格特征、思维模式和沟通风格，通过文字、图片、音频、视频等方式与人类进行情感互动的产品或者服务。

【《办法》合规要点提示：

1.用户状态识别：拟人化互动服务的提供者应当具备用户状态识别能力，对存在极端情绪或可能沉迷的用户、涉及威胁用户生命健康和财产安全的问题，及时采取措施予以干预。

2.未成年人保护：提供者应当建立未成年人模式，具备识别未成年人身份的能力，向未成年人提供情感陪伴服务时，应当取得监护人的明确同意，提供监护人控制功能。未成年人模式下收集数据向第三方提供时，还需取得监护人单独同意。

3.模型训练单独同意：将用户交互数据、用户敏感个人信息用于模型训练应当取得用户单独同意。

4.防沉迷：提供者应当显著提示用户正在与人工智能而非自然人进行交互，在用户初次使用、重新登录时，应当以弹窗等方式动态提醒用户交互内容为人工智能生成，连续使用超过2个小时的，应当以弹窗等方式提示用户暂停使用。提供者应当具备便捷的退出情感陪伴服务的路径。

5.安全评估：具有拟人化互动服务的功能上线或者增设相关功能、注册用户达100万以上或者月活跃用户达10万以上等情形下，应当开展安全评估，向属地省级网信部门提交评估报告。关于该等安全评估的手续以及与当前大模型上线备案/登记手续的衔接，还有待进一步明确。】

【参见：

https://mp.weixin.qq.com/s/WULVqbb5Gs222VVLSpkuyw】

CAC released “Draft Interim Measures for the Management of Anthropomorphic AI Interactive Services”《人工智能拟人化互动服务管理暂行办法（征求意见稿）》

On December 27, the Cyberspace Administration of China(CAC) released the “Draft Interim Measures for the Management of Anthropomorphic AI Interactive Services”《人工智能拟人化互动服务管理暂行办法（征求意见稿）》. The Interim Measures apply to products or services utilizing AI technology to simulate human personality traits, thought patterns, and communication styles, engaging in emotional interactions with humans through text, images, audio, video, or other means within the territory of the People’s Republic of China.

[Key Compliance Points of the Measures:

1. User State Recognition: Providers of anthropomorphic interactive services must possess user state recognition capabilities. They shall promptly intervene when users exhibit extreme emotions or potential addiction, or when issues arise that threaten users' life, health, or property safety.

2. Minor Protection: Providers must establish a minor mode with the capability to identify minors. When providing emotional companionship services to minors, explicit consent from guardians must be obtained, and guardian control functions must be provided. When data collected in minor mode is provided to third parties, separate consent from guardians is also required.

3. Separate Consent for Model Training: Obtain separate user consent when using user interaction data or sensitive personal information for model training.

4. Anti-Addiction Measures: Providers must prominently notify users that they are interacting with artificial intelligence rather than a natural person. Upon initial use or re-login, providers must dynamically remind users via pop-ups that the interaction content is AI-generated. After continuous use exceeding two hours, providers must prompt users to pause usage via pop-ups. Providers must offer a convenient exit path from emotional companionship services.

5. Security Assessment: Security assessments must be conducted and submitted to the local provincial cyberspace administration when launching anthropomorphic interactive services, adding related features, reaching over 1 million registered users, or exceeding 100,000 monthly active users. Procedures for such assessments and their integration with current large model launch filing/registration processes require further clarification.]

[Reference:

https://mp.weixin.qq.com/s/WULVqbb5Gs222VVLSpkuyw]

2. 国家网络身份认证公共服务6项公共安全行业标准获批发布

《国家网络身份认证公共服务管理办法》已于2025年5月23日发布，并于7月15日实施。为支撑法规的落地与实施，近日公安部发布了2025年第2号《中华人民共和国公安部公共安全行业标准公告》，国家网络身份认证公共服务标准体系中6项公共安全行业标准正式发布，于2026年5月1日实施。其中包括GA/T 2366-2025 《国家网络身份认证公共服务个人身份信息处理要求》，规定了国家网络身份认证公共服务平台与接入机构应用系统交互过程中个人身份信息处理的总体要求、技术要求和管理要求。

【参见：

https://mp.weixin.qq.com/s/2CRsPNchgPPCW24eysISTg】

Six Public Security Industry Standards for National Online Identity Authentication Public Services Approved for Release

The “Administrative Measures for National Network Identity Authentication Public Services” was issued on May 23, 2025, and took effect on July 15. To support the implementation of these regulations, the Ministry of Public Security recently released Announcement No. 2 of 2025 on Public Security Industry Standards of the Ministry of Public Security of the People's Republic of China. Six public security industry standards within the national network identity authentication public service standard system were formally published and will take effect on May 1, 2026. Among these is GA/T 2366-2025 “National Network Identity Authentication Public Service - Personal Identity Information Processing Requirements,” which specifies the overall requirements, technical specifications, and management standards for processing personal identity information during interactions between the National Network Identity Authentication Public Service Platform and application systems of accessing institutions.

[Reference:

https://mp.weixin.qq.com/s/2CRsPNchgPPCW24eysISTg]

3. 福建自贸试验区数据出境负面清单发布

12月25日，福建省互联网信息办公室、福建省商务厅、福建省数据管理局联合发布《中国（福建）自由贸易试验区数据出境负面清单管理办法（试行）》《中国（福建）自由贸易试验区数据出境管理清单（负面清单）（2025版）》。其中，负面清单适用于在福建自贸试验区注册且在福建自贸试验区内开展数据出境活动的数据处理者，涉及医药、车联网、零售、航空维修等行业。

【参见：

https://www.fjwx.gov.cn/gs/20251225/3021854.html】

Fujian pilot free trade zone released negative list for data cross-border transfers

On December 25, the Fujian Cyberspace Administration, Fujian Commerce Department, and Fujian Data Administration jointly issued the “Administrative Measures for the Negative List of Data Cross-Border Transfers in the China (Fujian) Pilot Free Trade Zone (Trial)”《中国（福建）自由贸易试验区数据出境负面清单管理办法（试行）》and the “Management List for Data Cross-Border Transfers in the China (Fujian) Pilot Free Trade Zone (Negative List) (2025 Edition)” 《中国（福建）自由贸易试验区数据出境管理清单（负面清单）（2025版）》. The Negative List applies to data processors registered in the Fujian Pilot Free Trade Zone and conducting data cross-border activities within the zone, covering industries such as pharmaceuticals, connected vehicles, retail, and aviation maintenance.

[Reference:

https://www.fjwx.gov.cn/gs/20251225/3021854.html]

4. 中国网络空间安全协会发布完成个人信息收集使用优化改进App清单的公告（2025年第6批）

12月23日，中国网络空间安全协会发布公告称，协会组织指导酒店服务、网络社区、女性健康、远程会议和投资理财等5类6款App运营方，对照《中华人民共和国网络安全法》《中华人民共和国个人信息保护法》《常见类型移动互联网应用程序必要个人信息范围规定》等法律法规，重点针对超范围收集个人信息、过度调用敏感权限、权限设置和账号注销不便等个人信息收集使用问题完成了优化改进。6款App运营方已在应用商店或者官网上架优化改进版本，并承诺升级版本持续保持合规水平。

【参见：

https://mp.weixin.qq.com/s/FgKueZJ-QCrmJRhV3AkD1w】

CSAC announced the completion of list of apps optimized for personal information collection and use (Batch 6, 2025)

On December 23, the Cyberspace Security Association of China (CSAC) announced that it had guided operators of six apps across five categories—hotel services, online communities, women’s health, remote conferencing, and investment management—to complete optimization improvements. These improvements addressed issues in personal information collection and usage, focusing on excessive data collection beyond necessary scope, overuse of sensitive permissions, inconvenient permission settings, and cumbersome account cancellation processes. The enhancements were made in compliance with laws and regulations including the Cybersecurity Law the Personal Information Protection Law, and the Provisions on the Scope of Necessary Personal Information for Common Types of Mobile Internet Applications. The operators of these six apps have released optimized versions on app stores or their official websites and committed to maintaining compliance levels through ongoing updates.

[Reference:

https://mp.weixin.qq.com/s/FgKueZJ-QCrmJRhV3AkD1w]

5. 上海网信办发布三期生成式人工智能服务已备案/登记信息

12月23日、12月24日与12月25日，上海网信办各发布了一期上海市生成式人工智能服务已备案/登记信息公告。其中，12月23日公告新增12款已完成备案的生成式人工智能服务，12月24日公告新增9款已完成登记的生成式人工智能服务，12月25日公告新增9款已完成备案的生成式人工智能服务。截至12月25日，上海市累计已完成137款生成式人工智能服务备案。截至12月24日，累计已完成139款生成式人工智能服务登记。

【12月23日公告参见：

https://mp.weixin.qq.com/s/qoFsIhDye3HLOo2xD0RIvQ 

12月24日公告参见:

https://mp.weixin.qq.com/s/vGeKJ3T_4EwL40-Y1Wqn0Q

12月25日公告参见：

https://mp.weixin.qq.com/s/-FZVR8wURcAAGdKgudeFgg】

Shanghai Cyberspace Administration released three batches of generative AI service filing/registration information

On December 23, December 24, and December 25, the Shanghai Cyberspace Administration released three separate announcements detailing the filing/registration status of generative AI services in Shanghai. The December 23 announcement added 12 generative AI services that completed filing, the December 24 announcement added 9 generative AI services that completed registration, and the December 25 announcement added 9 generative AI services that completed filing. As of December 25, a cumulative total of 137 generative AI services have completed filing in Shanghai. As of December 24, a cumulative total of 139 generative AI services have completed registration.

[See the December 23 announcement:

https://mp.weixin.qq.com/s/qoFsIhDye3HLOo2xD0RIvQ

December 24 announcement:

https://mp.weixin.qq.com/s/vGeKJ3T_4EwL40-Y1Wqn0Q

December 25 announcement:

https://mp.weixin.qq.com/s/-FZVR8wURcAAGdKgudeFgg]

6. 个人信息出境认证依据标准变更

近日，国家市场监督管理总局、国家互联网信息办公室联合发布关于变更个人信息出境认证依据标准的公告。公告称，GB/T 46068《数据安全技术个人信息跨境处理活动安全认证要求》国家标准已发布。自公告发布之日起，《关于实施个人信息保护认证的公告》（国家市场监督管理总局、国家互联网信息办公室公告2022年第37号）附件《个人信息保护认证实施规则》中，涉及跨境处理活动的个人信息保护认证依据标准变更为GB/T 35273、GB/T 46068。

【参见：

https://mp.weixin.qq.com/s/_gcUOuhDM925VfYFtxuLKw】

Standards for cross-border personal information certification updated

Recently, the State Administration for Market Regulation and the CAC jointly issued an announcement regarding changes to the standards for cross-border personal information certification. The announcement states that the national standard GB/T 46068 “Data security technology— Security certification requirements for cross-border processing activity of personal information” has been released. Effective from the date of this announcement, the standards for personal information protection certification involving cross-border processing activities, as specified in the “Implementation Rules for Personal Information Protection Certification” attached to the “Announcement on the Implementation of Personal Information Protection Certification” (Announcement No. 37 of 2022 by the State Administration for Market Regulation and the Cyberspace Administration of China), shall be amended to GB/T 35273 and GB/T 46068.

[Reference:

https://mp.weixin.qq.com/s/_gcUOuhDM925VfYFtxuLKw]

1. 美国参议员提出《汽车数据隐私与自主权法案》（The Auto Data Privacy and Autonomy Act）

近日，美国一参议员提出了《汽车数据隐私与自主权法案》，赋予车主对其个人数据的控制权。该法案核心内容包括强制要求OEM为车辆数据采集设置主动选择加入功能；禁止OEM在未获明确同意的情况下共享、出售或租赁客户数据；禁止向敌对国家共享数据；允许车主通过技术中立标准访问车辆数据；赋予车主连接车辆后删除个人数据的权利等。

【参见：

https://www.lee.senate.gov/2025/12/lee-bill-protects-car-owners-from-data-harvesting】

US Senator proposed “ The Auto Data Privacy and Autonomy Act”

Recently, a US senator proposed the Auto Data Privacy and Autonomy Act, which grants car owners control over their personal data. The core content of the Act includes mandatory requirements for OEMs to set up active opt in features for vehicle data collection; Prohibit OEMs from sharing, selling, or leasing customer data without explicit consent; Prohibit sharing data with hostile countries; Allow car owners to access vehicle data through technology neutral standards; Granting car owners the right to delete personal data after connecting to the vehicle.

[Reference:

https://www.lee.senate.gov/2025/12/lee-bill-protects-car-owners-from-data-harvesting]