每周数据法律资讯 Data Law Weekly（20260427—20260503）

1.中央网信办部署开展“清朗・整治AI应用乱象”专项行动

4月30日，中央网信办印发通知，在全国范围内部署开展为期4个月的“清朗・整治AI应用乱象”专项行动，分两阶段推进。第一阶段，重点整治未按规定履行大模型备案登记义务、安全审核能力不足、大模型训练语料安全、AI数据投毒、生成合成内容标识落实不到位等问题，强化AI技术源头治理。第二阶段，聚焦利用AI技术生成“数字泔水”、制作发布虚假信息、散播暴力低俗等不良信息、假冒仿冒他人、侵害未成年人权益、从事网络水军活动等问题，坚决清理违法不良信息，依法处置处罚违规账号、MCN机构和网站平台。

【参见：

https://mp.weixin.qq.com/s/SgiSvANmylzzZ6N4pWCTPg】

CAC Launches Special Campaign to Rectify Chaos in AI Applications

On April 30, CAC issued a notice to launch a four-month national special campaign to rectify chaos in AI applications. The campaign consists of two phases: the first focuses on source governance, including failures to fulfill large model filing and registration obligations as required, insufficient security review capabilities, security of large model training data, AI data poisoning, and inadequate implementation of labeling requirements for generated and synthetic content, so as to strengthen the source governance of AI technology. The second phase focuses on issues such as generating "digital garbage" using AI technology, creating and publishing false information, spreading violent and vulgar content and other harmful information, impersonating others, infringing on the rights and interests of minors, and engaging in internet water army activities, resolutely clearing illegal and harmful information, and legally punishing illegal accounts, MCN institutions and website platforms. 

[Reference: 

https://mp.weixin.qq.com/s/SgiSvANmylzzZ6N4pWCTPg]

2.全国网安标委就5项网络安全国家标准征求意见

4月30日，全国网络安全标准化技术委员会就《网络安全技术基于多信道的证书申请和应用协议》《网络安全技术网络安全漏洞分类分级指南》《网络安全技术信息安全治理》《网络安全技术信息安全风险评估实施指南》《数据安全技术小型个人信息处理者个人信息保护指南》5项国家标准征求意见稿公开征求意见，相关标准材料已在网安标委官网发布。

【点击查阅标准原文：

https://www.tc260.org.cn/portal/suggestion】

National Technical Committee 260 on Cybersecurity of SAC Solicits Public Opinions on 5 National Standards

On April 30, the National Technical Committee 260 on Cybersecurity of SAC publicly solicited opinions on 5 draft national standards, including “Cybersecurity Technology Certificate Application and Application Protocol Based on Multi-Channel”, “Cybersecurity Technology Guidelines for Classification and Grading of Network Security Vulnerabilities”, “Cybersecurity Technology Information Security Governance”, “Cybersecurity Technology Implementation Guidelines for Information Security Risk Assessment”, and “Data Security Technology Guidelines for Personal Information Protection of Small-Scale Personal Information Processors”. Relevant standard materials have been released on the official website of SAC/TC 260. 

[Click to view the original standards: 

https://www.tc260.org.cn/portal/suggestion] 

3.国家计算机病毒应急处理中心通报67款违法违规收集个人信息App

4月30日，国家计算机病毒应急处理中心通报67款移动应用（含小程序）存在违法违规收集使用个人信息行为，涵盖在App首次运行时未通过弹窗等明显方式提示用户阅读隐私政策等收集使用规则；以默认选择同意隐私政策等非明示方式征求用户同意；隐私政策难以访问或无隐私政策；个人信息处理者在处理个人信息前，未以显著方式、清晰易懂的语言真实、准确、完整地向个人告知个人信息处理者的名称或者姓名、联系方式、个人信息的保存期限；未提供有效的更正、删除个人信息及注销用户账号功能、收集未成年人信息未取得监护人单独同意等13类问题，相关平台须在限期内整改。

【参见：

https://mp.weixin.qq.com/s/L22KfNK5GNRgE7jtTzQI8A?scene=1&click_id=34】

National Computer Virus Emergency Response Center Notifies 67 Apps for Illegal Collection of Personal Information

On April 30, the National Computer Virus Emergency Response Center reported 67 mobile applications (including mini-programs) for illegal collection and use of personal information, covering 13 types of violations. These violations include failing to prominently prompt users to read privacy policies and other collection and use rules through pop-ups or other obvious means when the App is run for the first time; soliciting users' consent through implicit means such as default selection of agreeing to the privacy policy; inaccessible or non-existent privacy policies; failure of personal information processors to truthfully, accurately and completely inform individuals of the processor's name, contact information, and the retention period of personal information in a prominent and easy-to-understand manner before processing personal information; lack of effective functions for correcting, deleting personal information and canceling user accounts; and collecting minor information without obtaining separate consent from guardians. Relevant platforms are required to rectify within a time limit.

[Reference: 

https://mp.weixin.qq.com/s/L22KfNK5GNRgE7jtTzQI8A?scene=1&click_id=34]

4.上海知识产权法院二审宣判上海首例AI大模型著作权侵权案

4月29日，上海知识产权法院二审宣判上海首例AI大模型著作权侵权案。法院明确，李某为模型训练将美杜莎角色形象图片输入LoRA模型的行为，只有在LoRA模型在用户指令下再次生成了与所输入的权利作品实质性相似的作品时，才构成对复制权的侵害，即仅将动漫角色图用于LoRA模型训练不必然构成复制权侵权，模型输出物实质性相似才构成侵权。对平台是否应当承担连带赔偿责任的问题，法院认为其仅提供技术服务、尽到了注意义务且采取了必要的防范及补救措施的，不承担连带责任。

【参见：

https://mp.weixin.qq.com/s/2ggCLyCGcUyBfPAaHbbAfg】

Shanghai Intellectual Property Court Upholds Verdict in Shanghai’s First AI Model Copyright Infringement Case on Appeal

On April 29, the Shanghai Intellectual Property Court rendered a second-instance verdict in Shanghai’s first AI model copyright infringement case. The court clarified that Li’s act of inputting images of the Medusa character into the LoRA model for model training constitutes an infringement of the right of reproduction only when the LoRA model generates works substantially similar to the copyrighted works inputted under user instructions. In other words, merely using cartoon character images for LoRA model training does not necessarily constitute an infringement of the right of reproduction; infringement occurs only when the output of the model is substantially similar. Regarding whether the platform should bear joint and several liability for compensation, the court held that platforms that only provide technical services, fulfill their duty of care, and take necessary preventive and remedial measures shall not bear joint and several liability. 

[Reference: 

https://mp.weixin.qq.com/s/2ggCLyCGcUyBfPAaHbbAfg]

5.上海市通信管理局开展“铸盾车联” 2026年车联网网络和数据安全专项行动

4月29日，上海市通信管理局部署开展“铸盾车联”2026年车联网网络和数据安全专项行动，重点对象涵盖在上海市生产、销售智能网联汽车产品的企业，运营车联网相关平台的服务企业，车联网网络设施和车路协同设施运营企业，自动驾驶功能产品和解决方案服务企业，以及基础电信企业。主要任务包括：落实网络和数据安全主体责任，鼓励建立首席数据官制度；加强车联网平台安全防护定级备案，三级及以上系统每年开展符合性评测和风险评估，二级每两年一次；强化智能网联汽车产品及车联网应用程序安全检测；做好重要数据识别及目录备案（条目或总量变化30%以上三个月内更新），每年开展数据安全风险评估；L3及以上自动驾驶功能在开展测试、示范、运营前须安全检测报备并建立监测预警机制等。

【点击查阅：

https://shca.miit.gov.cn/zwgk/zcwj/wjfb/art/2026/art_d74597e4e6bb4b16b53d6ff01dcc0b9e.html】

Shanghai Communications Administration Launches 2026 Special Action on Cybersecurity and Data Security for IoV

On April 29, the Shanghai Communications Administration launched the 2026 ‘Shielding IoV’ special action on cybersecurity and data security for the Internet of Vehicles. The key targets include enterprises producing and selling intelligent connected vehicle products in Shanghai, service enterprises operating IoV-related platforms, operators of IoV network facilities and vehicle-road coordination facilities, service enterprises of autonomous driving function products and solutions, and basic telecommunications enterprises. The main tasks include: implementing the main responsibility for network and data security and encouraging the establishment of a chief data officer system; strengthening the classification and filing of security protection for IoV platforms, requiring level 3 and above systems to conduct compliance evaluation and risk assessment every year, and level 2 systems every two years; strengthening the security testing of intelligent connected vehicle products and IoV applications; doing a good job in the identification of important data and directory filing (updating within three months if the number of entries or total volume changes by more than 30%), and conducting annual data security risk assessment; and requiring L3 and above autonomous driving functions to conduct safety testing and filing and establish monitoring and early warning mechanisms before carrying out testing, demonstration and operation. 

[Click to view: 

https://shca.miit.gov.cn/zwgk/zcwj/wjfb/art/2026/art_d74597e4e6bb4b16b53d6ff01dcc0b9e.html]

6.国家网信办发布个人信息保护政策法规问答（2026年4月）

4月29日，国家网信办发布个人信息保护政策法规问答，针对法规规章中涉及的个人信息数量统计口径予以明确，如“处理超过1000万人个人信息”，在计数中，均包含本数，按当前处理所涉自然人数量统计，不含已删除信息。在个人信息保护合规审计频度方面，处理超过1000万人个人信息的，应当每两年至少开展一次；参照国家标准，处理超过100万、不超过1000万人个人信息的，每三年或四年至少开展一次；处理不超过100万人个人信息的，每五年至少开展一次。关于未成年人个人信息保护合规审计，无论是否对未成年人身份进行识别，都应每年对其处理未成年人个人信息遵守法律、行政法规的情况进行合规审计。

【参见：

https://mp.weixin.qq.com/s/EPq55lqn8_xMGcrLxXQnZw】

CAC Issues Q&A on Personal Information Protection Policies (April 2026)

On April 29, CAC issued a Q&A on personal information protection policies, clarifying the statistical standards for the volume of personal information involved in laws and regulations, for example, ‘processing personal information of more than 10 million people’ includes the number itself, which is counted based on the number of natural persons currently being processed, excluding deleted information. In terms of the frequency of compliance audits for personal information protection, those processing personal information of more than 10 million people shall conduct at least one audit every two years; with reference to national standards, those processing personal information of more than 1 million but not more than 10 million people shall conduct at least one audit every three or four years; and those processing personal information of not more than 1 million people shall conduct at least one audit every five years. Regarding the compliance audit of minor personal information protection, regardless of whether the minor’s identity is identified, an annual compliance audit shall be conducted on the compliance with laws and administrative regulations in processing minor personal information.

 [Reference:

https://mp.weixin.qq.com/s/EPq55lqn8_xMGcrLxXQnZw]

7.中央网信办通报33款App存在个人信息收集使用违法违规问题

4月27日，中央网信办通报33款App（含小程序）存在个人信息收集使用违法违规问题，包括首次运行时未通过弹窗等明显方式提示用户阅读隐私政策等收集使用规则、未逐一列出收集使用个人信息的SDK、违反必要原则，收集与其提供的服务无关的个人信息、未提供有效账号注销途径等情形，要求运营者15个工作日内完成整改并报送情况。

【参见：

https://mp.weixin.qq.com/s/mMIu5sw0ZN1zlG8xFVAPiQ】

CAC Notifies 33 Apps for Illegal Personal Information Collection

On April 27, CAC notified 33 Apps (including mini-programs) for illegal collection and use of personal information, covering situations include: failing to prominently prompt users to read privacy policies and other collection and use rules through pop-ups or other obvious means when run for the first time, failing to list each SDK that collects and uses personal information one by one, collecting personal information irrelevant to the services provided in violation of the principle of necessity, and failing to provide effective account cancellation channels. Operators are required to complete rectification within 15 working days and submit a report. 

[Reference: 

https://mp.weixin.qq.com/s/mMIu5sw0ZN1zlG8xFVAPiQ]

8.北京市互联网信息办公室等三部门印发数据跨境流动便利化综合配套改革实施方案

近期，北京市互联网信息办公室等三部门联合印发《关于进一步深化数据跨境流动便利化综合配套改革实施方案》，全面推进数据出境负面清单管理模式由自贸试验区向全市推广应用，覆盖汽车、医药、零售、民航、人工智能、自动驾驶、医疗器械、贸易物流、银行等9个领域，并深化个人信息出境认证制度；同时优化数据出境服务受理流程，允许企业在申报过程中同步完善相关材料；打造国际医药创新公园“药数驿站通”等特色服务高地，推进个人信息匿名化应用试点，明确经匿名化处理的数据可自由流动；在安全监管上实施“信用+风险”分类分级精准监管，形成越合规、越便利的良性循环，旨在建设全国数据跨境流动便利化政策创新实践高地和全球数据资源流通重要枢纽，更好服务首都高质量发展。

【参见：

https://mp.weixin.qq.com/s/Q9VzhYFZ7QSQgBdAjLbn9w】

Beijing Cyberspace Administration and Two Other Departments Issue Comprehensive Reform Plan for Cross-Border Data Flow Facilitation

Recently, the Beijing Cyberspace Administration and two other departments jointly issued the ‘Implementation Plan for Further Deepening the Comprehensive Supporting Reform for the Facilitation of Cross-Border Data Flow’. The plan comprehensively promotes the city-wide application of the data outbound negative list management model from the pilot free trade zone, covering 9 fields including automobiles, medicine, retail, civil aviation, artificial intelligence, autonomous driving, medical devices, trade and logistics, and banking, and deepens the personal information outbound certification system. At the same time, it optimizes the acceptance process of data outbound services, allowing enterprises to improve relevant materials simultaneously during the declaration process; builds characteristic service highlands such as the "Pharmaceutical Data Station" in the International Pharmaceutical Innovation Park, promotes pilot projects for the application of anonymized personal information, and clarifies that anonymized data can flow freely; implements ‘credit + risk’ classified and precise supervision in terms of safety supervision, forming a virtuous cycle of more compliance and more convenience. It aims to build a national policy innovation and practice highland for cross-border data flow facilitation and an important hub for global data resource circulation, so as to better serve the high-quality development of the capital. 

[Reference: 

https://mp.weixin.qq.com/s/Q9VzhYFZ7QSQgBdAjLbn9w]

9.网信部门依法查处“剪映”等未落实AI生成合成内容标识违规平台

近日，网信部门依法查处“剪映”“猫箱”App及“即梦AI”网站，查实其未按规定落实AI生成合成内容标识义务，违反《网络安全法》《人工智能生成合成内容标识办法》等规定，网信部门依法对上述网站平台采取约谈、责令改正、警告、从严处理责任人等处置措施。

【参见：

https://mp.weixin.qq.com/s/yBRnC7pRlKFtQMXQ9i8LFg】

Cyberspace Authorities Penalize Platforms Including Jianying for Violating AI-Generated Content Labeling Rules

Recently, cyberspace authorities have legally penalized the Jianying and Maoxiang Apps and the Jimeng AI website, confirming that they failed to fulfill the obligation of labeling AI-generated and synthetic content in accordance with regulations, in violation of the “Cybersecurity Law” and the “Measures for Labeling AI-Generated Synthetic Content” and other regulations. The cyberspace authorities have taken enforcement measures against the aforementioned platforms, including conducting interviews, ordering corrections, issuing warnings, and strictly holding responsible parties accountable. 

[Reference:

https://mp.weixin.qq.com/s/yBRnC7pRlKFtQMXQ9i8LFg]

1.美国国会参议员推出《儿童健康、进步、信任、界限和技术监管法案》，强化未成年人AI聊天机器人监管

4月28日，美国国会参议员推出《儿童健康、进步、信任、界限和技术监管法案》（CHATBOT 法案），该法案将要求人工智能公司为家长设立“家庭账户”，以便家长管理其子女对人工智能聊天机器人的访问和使用。该法案将限制人工智能聊天机器人的操控性设计，要求家长同意才能使用聊天机器人，并提供家长控制功能以访问和监控儿童与聊天机器人的对话；同时禁止向儿童投放定向广告。

【参见：

https://www.commerce.senate.gov/press/rep/release/cruz-schatz-curtis-schiff-introduce-new-bill-giving-parents-control-over-kids-ai-chatbot-use/】

US Senator Introduces The Children’s Health, Advancement, Trust, Boundaries, and Oversight in Technology Act, to Strengthen Regulation of AI Chatbots for Minors

On April 28, U.S. senators introduced the Children’s Health, Advancement, Trust, Boundaries, and Oversight in Technology Act (CHATBOT Act). The act will require artificial intelligence companies to establish ‘family accounts’ for parents to manage their children’ s access to and use of artificial intelligence chatbots. The act will restrict the manipulative design of artificial intelligence chatbots; require parental consent for the use of chatbots, and provide parental control functions to access and monitor children's conversations with chatbots; at the same time, it will prohibit targeted advertising to children.

[Reference:

https://www.commerce.senate.gov/press/rep/release/cruz-schatz-curtis-schiff-introduce-new-bill-giving-parents-control-over-kids-ai-chatbot-use/]

2.意大利监管部门结束对DeepSeek AI幻觉风险问题的调查

4月30日，意大利竞争管理局宣布结束了对DeepSeek等公司开展的三项调查。近几个月来，意大利竞争管理局特别关注生成式人工智能系统的幻觉风险，即生成不准确或误导性内容的风险，由此，其对DeepSeek等公司开展了三项调查。这三项调查均以企业作出承诺的方式结案，DeepSeek等公司已同意采取具体措施，以提高其系统中“幻觉”风险的透明度，包括在用户界面的聊天窗口下方添加永久性免责声明，通过意大利语向用户警示“幻觉”风险，并附有专门的超链接。DeepSeek还同意加强技术研究投资，以降低“幻觉”风险，同时承认现有技术无法完全防止此类情况发生。

【参见：

https://en.agcm.it/en/media/press-releases/2024/4/PS12942-PS12968-PS12973】

Italian Regulators Conclude Investigation into DeepSeek AI’s Hallucination Risks

On April 30, the Italian Competition Authority announced the conclusion of three investigations into companies including DeepSeek. In recent months, the Italian Competition Authority has focused particularly on the hallucination risks of generative AI systems—the risk of generating inaccurate or misleading content—and consequently launched three investigations into companies such as DeepSeek. All three investigations were concluded with commitments from the companies involved. DeepSeek and others have agreed to take specific measures to improve transparency regarding “hallucination” risks in their systems, including adding a permanent disclaimer below the chat window in the user interface, warning users about “hallucination” risks in Italian, and providing a dedicated hyperlink. DeepSeek has also agreed to increase investment in technical research to mitigate the risk of “hallucinations,” while acknowledging that current technology cannot completely prevent such occurrences.

[Reference:

https://en.agcm.it/en/media/press-releases/2024/4/PS12942-PS12968-PS12973]