每周数据法律资讯 Data Law Weekly（20260105—20260111）

1. 国家网信办发布《互联网应用程序个人信息收集使用规定（征求意见稿）》

1月10日，国家网信办发布《互联网应用程序个人信息收集使用规定（征求意见稿）》。《规定》适用于在中华人民共和国境内运营互联网应用程序过程中收集使用个人信息，以及软件开发工具包、分发平台、智能终端等为互联网应用程序收集使用个人信息活动提供服务；同时，也适用于在中华人民共和国境外收集使用中华人民共和国境内自然人个人信息并符合《中华人民共和国个人信息保护法》第三条第二款规定情形的活动。

【参见：

https://mp.weixin.qq.com/s/CLEKMXlP6c_I2xkfb4wcpw】

CAC released the “Regulation on the Collection and Use of Personal Information by Internet Applications (Draft for Comment)”《互联网应用程序个人信息收集使用规定（征求意见稿）》

On January 10, the Cyberspace Administration of China (CAC) released the “Regulation on the Collection and Use of Personal Information by Internet Applications (Draft for Comment).”《互联网应用程序个人信息收集使用规定（征求意见稿）》 The Regulation apply to the collection and use of personal information during the operation of internet applications within the territory of the People’s Republic of China, as well as to software development kits, distribution platforms, smart terminals, and other entities providing services for the collection and use of personal information by internet applications; it also apply to activities outside the PRC that involve the collection and use of personal information of natural persons within the PRC, provided such activities meet the conditions specified in Article 3, Paragraph 2 of the Personal Information Protection Law.

[Reference:

https://mp.weixin.qq.com/s/CLEKMXlP6c_I2xkfb4wcpw]

2. 上海公安网安部门公布2025年10起打击整治网络违法犯罪典型案例

1月10日，上海公安网安部门公布2025年10起打击整治网络违法犯罪典型案例。这十起案例涉及种类包括新型网络犯罪、黑客、侵犯公民个人信息、网络谣言、网络舆情敲诈等。

【参见：

https://mp.weixin.qq.com/s/7g51nltu7rIoe2-V4Q1W4A】

Shanghai Public Security Bureau Cyber Security Department releases 10 representative cases of cracking down on and rectifying online illegal activities in 2025

On January 10, the Shanghai Public Security Bureau Cyber Security Department released 10 representative cases of cracking down on and rectifying online illegal activities in 2025. These cases encompass various types, including new forms of cybercrime, hacking-related offenses, violations of citizens' personal information, online rumor-mongering, and online public opinion extortion.

[Reference:

https://mp.weixin.qq.com/s/7g51nltu7rIoe2-V4Q1W4A]

3. 国家网信办发布《个人信息保护政策法规问答（2026年1月）》

1月9日，国家网信办发布《个人信息保护政策法规问答（2026年1月）》。《问答》重申了个人信息、敏感个人信息的概念与类型，同时就应用人脸识别技术处理人脸信息的个人信息保护影响评估方法与个人信息处理者指定个人信息保护负责人和报送负责人信息的相关问题进行了解答。

【参见：

https://mp.weixin.qq.com/s/IKeZ6d1-eicM54ab0ElNFw】

CAC released “Q&A on Personal Information Protection Policies and Regulations (January 2026)”

On January 9, CAC released the “Q&A on Personal Information Protection Policies and Regulations (January 2026).” The Q&A reiterates the concepts and classifications of personal information and sensitive personal information. It also addresses issues concerning the impact assessment methods for processing facial information using facial recognition technology, as well as the designation of personal information protection officers and the reporting of officer information by personal information processors.

[Reference:

https://mp.weixin.qq.com/s/IKeZ6d1-eicM54ab0ElNFw]

4. 国家网信办发布2025年生成式人工智能服务已备案信息公告

1月9日，国家网信办发布2025年生成式人工智能服务已备案信息公告。公告称，2025年全年新增446款生成式人工智能服务在国家网信办完成备案，对于通过API接口或其他方式直接调用已备案模型能力的生成式人工智能应用或功能，由地方网信办开展登记，新增330款完成登记。截至2025年12月31日，累计有748款生成式人工智能服务完成备案，435款生成式人工智能应用或功能完成登记。

【参见：

https://mp.weixin.qq.com/s/SQellq6ol6MI5r7MhQbrPw】

CAC released announcement on Generative AI services filing in 2025

On January 9, CAC released the 2025 Generative AI Services Filing Information Announcement. The announcement states that 446 new generative AI services completed filing with CAC throughout 2025. For generative AI applications or features that directly invoke filed model capabilities via API interfaces or other methods, registration is conducted by local cyberspace administration offices, with 330 new entries completing registration. As of December 31, 2025, a cumulative total of 748 generative AI services had completed filing, while 435 generative AI applications or functionalities had completed registration.

[Reference:

https://mp.weixin.qq.com/s/SQellq6ol6MI5r7MhQbrPw]

5. 市场监管总局、国家网信办联合发布《网络交易平台规则监督管理办法》

近日，市场监管总局、国家网信办联合发布了《网络交易平台规则监督管理办法》。《办法》适用于网络交易平台经营者开展平台规则制定、修改和执行活动以及市场监督管理、网信部门依据职责对其进行的监督管理。《办法》第四条规定，平台规则，是指网络交易平台经营者为服务不特定网络交易各方主体、管理平台内交易相关活动而预先拟定、供各方遵守的服务协议和交易规则的总称，包括网络交易平台服务协议、对平台内经营者的管理规则、平台内交易及纠纷处理规则、个人信息保护规则、知识产权保护规则等。《办法》将于2026年2月1日起施行。

【参见：

https://mp.weixin.qq.com/s/acdIZeUsNXmQ4Vaa6gwceA】

SAMR and CAC jointly issued the “Measure for the Supervision and Administration of Online Trading Platform Rules”（《网络交易平台规则监督管理办法》）

Recently, the State Administration for Market Regulation(SAMR) and CAC jointly issued the “Measure for the Supervision and Administration of Online Trading Platform Rules.”（《网络交易平台规则监督管理办法》） The Measure apply to the formulation, amendment, and enforcement of platform rules by online trading platform operators, as well as the supervision and administration conducted by market regulation and cyberspace authorities in accordance with their respective responsibilities. Article 4 defines platform rules as the collective term for service agreements and transaction rules pre-established by online transaction platform operators to serve unspecified parties in online transactions and manage platform-related activities. These include online transaction platform service agreements, management rules for platform operators, rules governing platform transactions and dispute resolution, personal information protection rules, and intellectual property protection rules. The Measure will take effect on February 1, 2026.

[Reference:

https://mp.weixin.qq.com/s/acdIZeUsNXmQ4Vaa6gwceA]

6. 市场监管总局、国家网信办联合发布《直播电商监督管理办法》

近日，市场监管总局、国家网信办联合发布了《直播电商监督管理办法》。《办法》适用于在中华人民共和国境内从事直播电商活动以及市场监督管理、网信部门依据职责对其进行的监督管理。《办法》将于2026年2月1日起施行。

【参见：

https://mp.weixin.qq.com/s/ujwJG4kHTNOQebf7OUwWig】

SAMR and CAC jointly issued “Supervision and Administration Measures for Live-Streaming E-commerce”（《直播电商监督管理办法》）

Recently, SAMR and CAC jointly issued the “Supervision and Administration Measures for Live-Streaming E-commerce”（《直播电商监督管理办法》）. The Measure apply to live-streaming e-commerce activities conducted within the territory of the PRC, as well as the supervision and administration exercised by market regulation and cyberspace authorities in accordance with their respective responsibilities. The Measure will take effect on February 1, 2026.

[Reference:

https://mp.weixin.qq.com/s/ujwJG4kHTNOQebf7OUwWig]

7. 国家网信办发布第十五批深度合成服务算法备案信息公告

1月7日，国家网信办发布第十五批深度合成服务算法备案信息公告。具体信息可通过互联网信息服务算法备案系统（https://beian.cac.gov.cn）进行查询。《互联网信息服务深度合成管理规定》第十九条明确规定，具有舆论属性或者社会动员能力的深度合成服务提供者，应当按照《互联网信息服务算法推荐管理规定》履行备案和变更、注销备案手续。深度合成服务技术支持者应当参照履行备案和变更、注销备案手续。

【参见：
 

https://mp.weixin.qq.com/s/0jilUrpCAQWCT2OyIqpP7g】

CAC released Announcement on fifteenth batch of deep synthesis service algorithm filing information

On January 7, CAC released the announcement on the fifteenth batch of deep synthesis service algorithm filing information. Specific details can be queried through the Internet Information Service Algorithm Filing System (https://beian.cac.gov.cn). Article 19 of the “Regulation on the Management of Deep Synthesis in Internet Information Services” explicitly stipulates that providers of deep synthesis services possessing public opinion attributes or social mobilization capabilities shall fulfill filing, amendment, and cancellation procedures in accordance with the “Regulations on the Management of Algorithm Recommendations in Internet Information Services”. Technical supporters of deep synthesis services shall refer to these regulations when fulfilling filing, amendment, and cancellation procedures.

[Reference:

https://mp.weixin.qq.com/s/0jilUrpCAQWCT2OyIqpP7g]

8. 工信部通报22款存在问题的APP（SDK）

1月6日，工业化和信息化部通信管理局发布《关于侵害用户权益行为的APP（SDK）通报》（2026年第1批，总第54批），共涉及24款APP（SDK）。这些APP（SDK）所涉问题有：违规收集个人信息、超范围收集个人信息、强制自动续费、未明示个人信息清单、信息窗口点击乱跳转、APP强制、频繁、过度索取权限、SDK信息公示不到位等。

【参见：

https://mp.weixin.qq.com/s/dh4feKx5k9XFlRARhlbFDw】

MIIT Issues Notice on 22 Problematic Apps (SDKs)

On January 6, the Communications Administration of the Ministry of Industry and Information Technology (MIIT) released the “Notice on Apps (SDKs) Violating User Rights” (Batch 1 of 2026, 54th overall), involving 24 apps (SDKs). Issues identified in these apps (SDKs) include: Illegal collection of personal information; Collection of personal information beyond authorized scope; Forced automatic renewals; Failure to clearly display personal information lists; Random redirects upon clicking information windows; Apps forcibly, frequently, or excessively requesting permissions; Inadequate SDK information disclosure.

9. 国家网络安全通报中心通报71款违法违规收集使用个人信息的移动应用

1月5日，国家网络安全通报中心对71款存在违法违规收集使用个人信息情况的移动应用进行了通报。本次通报新增移动应用违规问题：“实现相同目的或者达到同等业务要求，存在其他非人脸识别技术方式的，将人脸识别技术作为唯一验证方式”。此外，这些移动应用存在的问题还包括：在App首次运行时未通过弹窗等明显方式提示用户阅读隐私政策等收集使用规则；隐私政策难以访问；隐私政策未逐一列出App（包括委托的第三方或嵌入的第三方代码、插件）收集使用个人信息的目的、方式、范围等；个人信息处理者向其他个人信息处理者提供其处理的个人信息的，未向个人告知接收方的名称或者姓名、联系方式、处理目的、处理方式和个人信息的种类，并取得个人的单独同意；未在征得用户同意后才开始收集个人信息或打开可收集个人信息的权限；未提供有效的更正、删除个人信息及注销用户账号功能；为更正、删除个人信息或注销用户账号设置不必要或不合理条件；虽提供了更正、删除个人信息及注销用户账号功能，但未及时响应用户相应操作，需人工处理的，未在承诺时限内完成核查和处理等。

【参见：

https://mp.weixin.qq.com/s/5eqwgY8kgwS9kRnsJnGReg】

National Cybersecurity Notification Center reported 71 Mobile Apps for illegal collection and use of personal information

On January 5, the National Cybersecurity Notification Center issued a report on 71 mobile applications found to be illegally collecting and using personal information. This report introduced a new category of violations: “Using facial recognition technology as the sole verification method when alternative non-facial recognition technologies exist to achieve the same purpose or meet equivalent business requirements.” Additionally, these mobile applications exhibited the following issues: Failing to prominently notify users to read privacy policies and collection/usage rules via pop-ups or similar methods during the app's initial launch; Privacy policies being difficult to access; Privacy policies failing to itemize the purposes, methods, and scope of personal information collection and usage by the app (including third parties commissioned or embedded third-party code/plugins); When personal information processors provide processed personal information to other processors, they fail to inform individuals of the recipient's name, contact details, processing purpose, methods, and types of personal information, nor obtain separate consent; Collecting personal information or enabling data collection permissions without prior user consent; Failing to provide effective functions for correcting, deleting personal information, or canceling user accounts; Imposing unnecessary or unreasonable conditions for correcting, deleting personal information, or canceling user accounts; Providing functions for correcting, deleting personal information, or canceling user accounts but failing to respond promptly to corresponding user operations, or failing to complete verification and processing within the promised timeframe when manual processing is required.

[Reference:

https://mp.weixin.qq.com/s/5eqwgY8kgwS9kRnsJnGReg]

1. 德国发布GDPR项下“合法利益”的评估模版

1月6日，德国汉堡数据保护和信息自由专员发布用于确定 “合法利益” （ legitimate interest）的评估模版。评估模版强调，根据GDPR第6（1）（f）条，“合法利益”是GDPR为合法处理个人数据提供的六个法律依据之一。这一核心且具有挑战性的合法性基础，既不应在其他处理个人数据的合法性基础同样适用的罕见或意外情形下过早选用，也不应仅因其看似比其他合法性基础限制较少而被简单套用。尽管GDPR列举了合法利益的示例，但并未提供详尽清单，数据控制者必须在每个具体案例中审慎评估并记录是否满足合法利益的适用条件。要使数据处理基于合法利益，必须同时满足三个条件：必须存在合法利益、处理个人数据必须是实现该利益所必需的、数据主体的利益或基本权利与自由不得凌驾于该利益之上。

【参见：

https://datenschutz-hamburg.de/news/hmbbfdi-veroeffentlicht-fragenkatalog-zur-interessenabwaegung-nach-dsgvo】

Germany released assessment template for “legitimate interest” of GDPR

On January 6, the Hamburg Commissioner for Data Protection and Freedom of Information released an assessment template for determining “legitimate interest.” The template emphasizes that legitimate interest pursuant to Article 6(1)(f) of the GDPR is one of the six legal bases provided for by the GDPR for the lawful processing of personal data. This central and at the same time challenging legal basis should neither be selected prematurely for rare or unexpected cases in which other legal bases for processing personal data could apply, nor should it be applicated simply because it appears to be less restrictive than other legal bases. While the GDPR does contain examples of legitimate interests, there is no exhaustive list, and controllers are obliged to always carefully examine and document in each specific case whether the conditions for a legitimate interest are met.In order for data processing to be based on legitimate interest, three conditions must be cumulatively fulfilled：There must be a legitimate interest; The processing of personal data must be necessary to pursue this interest; The interests or fundamental rights and freedoms of the data subject must not outweigh this interest.

[Reference:

https://datenschutz-hamburg.de/news/hmbbfdi-veroeffentlicht-fragenkatalog-zur-interessenabwaegung-nach-dsgvo]