每周数据法律资讯 Data Law Weekly（20260727—20260802）

1.上海市网信办发布关于属地App个人信息收集使用问题的通报（2026年第四批-酒店住宿专项）

7 月 31 日，上海市互联网信息办公室发布2026年第四批属地App个人信息收集使用问题专项通报，本次专项整治聚焦酒店住宿类应用，共计查出7款App存在个人信息处理违规情形。主要问题涵盖未经用户同意收集使用个人信息、强制用户同意收集非必要个人信息、强制使用人脸识别技术进行身份验证、为注销用户账号设置不必要或不合理条件、超出最低必要频率调用个人信息权限、未及时响应个人信息权益诉求、告知收集使用个人信息目的、方式、范围与实际收集使用情况不一致。

【参见：

https://mp.weixin.qq.com/s/4Yurmd4zVoVTVtOoVZJfMA】
 

Shanghai Cyberspace Administration Issues Notice on Personal Information Collection and Use by Locally Registered Apps (2026 Fourth Batch-Hotel and Accommodation Sector)

On July 31, the Shanghai Cyberspace Administration issued the fourth batch of its 2026 special notice on personal information collection and use by locally registered apps, focusing on hotel and accommodation applications. A total of seven apps were found to have violated requirements for the processing of personal information. The identified issues included collecting and using personal information without users’ consent, requiring users to consent to the collection of unnecessary personal information, mandating facial recognition for identity verification, imposing unnecessary or unreasonable conditions for account cancellation, requesting access to personal information permissions more frequently than necessary, failing to respond promptly to requests relating to individuals' personal information rights, and inconsistencies between the notified purposes, methods and scope of personal information processing and actual processing practices.

[Reference:

https://mp.weixin.qq.com/s/4Yurmd4zVoVTVtOoVZJfMA]

2.国家网信办就《中华人民共和国反网络暴力法（征求意见稿）》公开征求意见

7月29日，国家网信办就《中华人民共和国反网络暴力法（征求意见稿）》公开征求意见。征求意见稿明确网络暴力概念定义和治理原则，界定网络暴力为通过网络对个人、组织集中或者持续实施的侵害名誉权、荣誉权、隐私权、肖像权、个人信息等合法权益的活动。压实网络服务提供者主体责任，要求平台建立网络暴力监测识别机制和防护功能，完善辟谣机制、账号处置申诉渠道及快捷取证功能，对利用人工智能技术实施网络暴力活动风险采取相应措施。

【参见：

https://mp.weixin.qq.com/s/PrzKFhbwjgFEGBPADvFD6Q?scene=1&click_id=34548522】
 

CAC Releases “Draft Anti-Cyberbullying Law of the People’s Republic of China” for Public Consultation

On July 29, the Cyberspace Administration of China (CAC) released the Anti-Cyberbullying Law of the People’s Republic of China (Draft for Public Comment) for public consultation. The draft clarifies the definition and governance principles of cyberbullying, defining it as activities that use the internet to infringe, in a concentrated or continuous manner, upon the lawful rights and interests of individuals or organizations, including their rights to reputation, honor, privacy, likeness, and personal information. It reinforces the primary responsibilities of online service providers, requiring platforms to establish cyberbullying monitoring and identification mechanisms and protective functions, improve rumor-refutation mechanisms, provide appeal channels for account-related enforcement actions and expedited evidence-preservation tools, and adopt appropriate measures to address risks arising from the use of artificial intelligence technologies to engage in cyberbullying.

[Reference:

https://mp.weixin.qq.com/s/PrzKFhbwjgFEGBPADvFD6Q?scene=1&click_id=34548522]

3.全国网安标委就两项AI网络安全标准实践指南公开征求意见

7月29日，全国网安标委就两项AI网络安全标准实践指南公开征求意见。《智能体交互安全要求》面向智能体与智能体、智能体与工具两类交互场景，构建了通用安全、智能体间交互安全、智能体与工具交互安全三级要求体系，包括身份标识、访问控制、通信安全、风险主动防范、异常检测、攻击分析、应急响应和攻击溯源等要求。《AI浏览器安全实践指南》聚焦AI浏览器在自动化网页交互、跨站数据提取、用户行为代理等能力下的安全风险，提出涵盖系统功能劫持、模型对抗攻击、模型可靠性、供应链安全、通信安全等五大风险类别，并给出7类安全防护实践要求。

【参见：

https://mp.weixin.qq.com/s/S2ONyeM8EgQz-Y-X8dwptw】
 

National Technical Committee 260 on Cybersecurity of SAC Seeks Public Comments on Two AI Cybersecurity Practice Guidelines

On July 29, the National Technical Committee 260 on Cybersecurity of SAC released two AI cybersecurity practice guidelines for public consultation. The Security Requirements for AI Agent Interactions establishes a three-tier security framework covering general security, AI agent-to-agent interactions and AI agent-to-tool interactions, with requirements relating to identity authentication, access control, communication security, proactive risk prevention, anomaly detection, attack analysis, incident response and attack traceability. The AI Browser Security Practice Guidelines focuses on security risks associated with AI browsers, including automated web interactions, cross-site data extraction and user behavior automation. It identifies five major categories of risks-system function hijacking, adversarial model attacks, model reliability, supply chain security and communication security-and proposes seven categories of security protection measures.

[Reference:

https://mp.weixin.qq.com/s/S2ONyeM8EgQz-Y-X8dwptw]

4.上海深入整治AI应用乱象，严防技术滥用侵害未成年人

7月28日，上海市网信办通报“清朗・整治 AI 应用乱象”第二阶段整治成效，自6月下旬专项行动开展以来，属地平台累计清理AI生成不良信息174万余条，处置违规账号4200余个。针对暑期未成年人用网特点，上海市网信办指导重点平台加强AI生成合成信息治理，集中整治AI技术滥用侵害未成年人权益问题。

【参见：

https://mp.weixin.qq.com/s/91-71KC5G8zFhpInP8UW0w】

Shanghai Cyberspace Administration Intensifies Crackdown on AI Application Misconduct to Prevent Technology Abuse Against Minors

On July 28, the Shanghai Cyberspace Administration announced the progress of the second phase of the “Qinglang-Rectification of AI Application Misconduct” campaign. Since the launch of the special campaign in late June, locally registered platforms have removed more than 1.74 million items of AI-generated illegal and harmful information and taken action against more than 4,200 non-compliant accounts. In response to minors’ internet use during the summer vacation, the Shanghai Cyberspace Administration directed major platforms to strengthen governance over AI-generated and synthetic content and intensify efforts to address the misuse of AI technologies that infringes upon minors’ rights and interests.

[Reference:

https://mp.weixin.qq.com/s/91-71KC5G8zFhpInP8UW0w]

5.中国网络空间安全协会发布第二批完成个人信息收集使用优化改进APP清单

7月28日，中国网络空间安全协会发布第二批完成个人信息收集使用优化改进APP清单，覆盖女性健康、婚恋相亲、手机银行、本地生活、二手车交易五大领域共5款应用。相关企业对照《个人信息保护法》等法律法规，重点针对超范围收集个人信息、过度调用敏感权限、权限设置和账号注销不便等个人信息收集使用问题完成了改进，并在各应用商店上线合规新版本，承诺升级版本持续保持合规水平。

【参见：

https://mp.weixin.qq.com/s/MnRDNkUzSWwP5W8J7RAgIg】

Cyber Security Association of China Releases Second List of Apps Completing Improvements to Personal Information Collection and Use Practices

On July 28, the CSAC released the second list of apps that have completed improvements to their personal information collection and use practices. The list covers five applications in the sectors of women's health, matchmaking, mobile banking, local lifestyle services and used-car trading. In accordance with the Personal Information Protection Law (PIPL) and other applicable laws and regulations, the relevant enterprises completed improvements targeting issues such as excessive collection of personal information, excessive requests for sensitive permissions, and inconvenient permission settings and account cancellation procedures. Updated compliant versions have been released through major app stores, and the enterprises committed to maintaining compliance in future versions.

[Reference:

https://mp.weixin.qq.com/s/MnRDNkUzSWwP5W8J7RAgIg]

6.上海市通信管理局通报2026年第五批侵害用户权益APP（SDK）

7月27日，上海市通信管理局通报2026年第五批侵害用户权益APP（SDK），共25款APP（SDK）存在侵害用户权益行为，涉及航空、交通出行、汽车服务、停车充电等多个领域。主要问题包括违规收集个人信息、未明示个人信息处理规则、未妥善处理用户投诉、账号注销困难等。监管要求相关运营主体立即整改，并开展个人信息和用户权益保护工作全面自评估，自通报之日起5个工作日内提交整改报告及自评估报告；对未按期完成整改并提交报告的企业，将依法依规予以处理。

【参见：

https://mp.weixin.qq.com/s/fy16HPHFSH5iNggZe8u04A?scene=1&click_id=1312776003】

Shanghai Communications Administration Issues the Fifth Batch of Apps (SDKs) Violating Users’ Rights and Interests in 2026

On July 27, the Shanghai Communications Administration issued the fifth batch of its 2026 notice on apps (SDKs) violating users’ rights and interests. A total of 25 apps (SDKs) across sectors including aviation, transportation, automotive services, and parking and charging services were found to have infringed users’ rights and interests. The identified issues included the unlawful collection of personal information, failure to disclose personal information processing rules, inadequate handling of user complaints, and difficulties in account cancellation. Regulators required the relevant operators to immediately carry out rectification, conduct comprehensive self-assessments of personal information protection and user rights protection, and submit rectification reports and self-assessment reports within five working days from the date of the notice. Enterprises that fail to complete rectification and submit the required reports within the prescribed timeframe will be dealt with in accordance with applicable laws and regulations.

[Reference:

https://mp.weixin.qq.com/s/fy16HPHFSH5iNggZe8u04A?scene=1&click_id=1312776003]

1.纽约州发布《儿童安全法案》最终实施规则

7月28日，纽约州发布《儿童安全法案》最终规则，要求平台对用户进行年龄确认；向未成年人提供算法个性化信息流或夜间通知须取得可验证的父母同意。平台还应提供身份证件以外的年龄确认方式，并限制相关数据的收集和使用。规则将于2027年1月25日生效。

【参见：

https://ag.ny.gov/press-release/2026/attorney-general-james-and-governor-hochul-release-final-safe-kids-act-rules】
 

New York Issues Final SAFE for Kids Act Rules

On July 28, New York issued final rules requiring platforms to conduct age assurance and obtain verifiable parental consent before providing minors with algorithmic feeds or nighttime notifications. Platforms must offer a non-ID-based method and limit related data processing. The rules take effect on January 25, 2027.

[Reference:

https://ag.ny.gov/press-release/2026/attorney-general-james-and-governor-hochul-release-final-safe-kids-act-rules]

2.欧盟《人工智能数字综合条例》在欧盟官方公报发布

近日，欧盟《人工智能数字综合条例》（Regulation (EU) 2026/1744）在欧盟官方公报上发布，并于7月27日生效。该条例对《人工智能法案》等法规作出针对性修订，包括将附件III所列高风险人工智能系统的适用日期延至2027年12月2日，将嵌入附件I产品的高风险人工智能系统的适用日期延至2028年8月2日；同时简化人工智能素养、欧盟数据库登记等要求，将部分中小企业优惠措施扩展至小型中等市值企业，并扩大监管沙盒和测试机制的适用范围。条例还进一步强化欧盟人工智能办公室对部分人工智能系统的监管权限。

【参见：

https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng】
 

EU Digital Omnibus on AI Published in the Official Journal

Recently, Regulation (EU) 2026/1744, known as the Digital Omnibus on AI, was published in the Official Journal of the European Union and entered into force on July 27. The Regulation introduces targeted amendments to the AI Act and related legislation. Among other changes, it postpones the application of requirements for high-risk AI systems listed in Annex III until December 2, 2027, and for high-risk AI systems embedded in products covered by Annex I until August 2, 2028. It also simplifies AI-literacy and EU-database registration requirements, extends certain SME-related measures to small mid-cap companies, expands access to regulatory sandboxes and testing arrangements, and strengthens the AI Office’s oversight of certain AI systems.

[Reference:

https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng]

3.欧盟委员会初步认定TikTok违反《数字服务法》，未能保障未成年人账户安全

近日，欧盟委员会向TikTok送达初步调查结论，认为其未成年人账户未达到《数字服务法》（DSA）要求的安全标准。目前，TikTok允许未成年人将账户设为“公开”，导致相关内容可能被包括非注册用户在内的全球公众访问；16至17岁未成年人发布的内容还可能通过“For You”信息流被推荐给其他用户。委员会初步认为，TikTok应将未成年人公开账户的默认可见范围限制为经未成年人接受的用户，并停止通过“For You”信息流推荐未成年人内容。该结论尚非最终决定，TikTok可查阅调查材料并作出回应。

【参见：

https://digital-strategy.ec.europa.eu/en/news/commission-preliminary-finds-tiktok-breach-digital-services-act-failing-ensure-safe-accounts-minors】

European Commission Preliminarily Finds TikTok in Breach of the Digital Services Act for Failing to Ensure Safe Accounts for Minors

Recently, the European Commission sent TikTok its preliminary findings that accounts belonging to minors do not meet the safety standards required under the Digital Services Act (DSA). TikTok currently allows minors to set their accounts to “public,” potentially making their content accessible to a global audience, including people without TikTok accounts. Content posted by minors aged 16 or 17 may also be recommended to other users through the “For You” feed. The Commission preliminarily considers that content from minors’ public accounts should, by default, be visible only to users accepted by the minor and should not be recommended through the “For You” feed. The findings do not constitute a final decision, and TikTok may examine the case file and respond.

[Reference:

https://digital-strategy.ec.europa.eu/en/news/commission-preliminary-finds-tiktok-breach-digital-services-act-failing-ensure-safe-accounts-minors]

4.欧盟委员会更新《人工智能法案》第50条透明度义务常见问题解答

近日，欧盟委员会更新关于《人工智能法案》第50条透明度义务的常见问题解答，进一步说明人工智能系统提供者和部署者的责任边界及具体适用场景。提供者应确保用户知悉其正在与人工智能系统交互，并对人工智能生成或操纵的内容添加有效、可靠且可互操作的机器可读标记；部署者应就情绪识别、生物特征分类系统、深度伪造内容，以及未经人工审查或编辑控制的公共利益事项人工智能生成文本履行告知或标识义务。相关义务自2026年8月2日起适用；对于此前投放市场的生成式人工智能系统，其内容标记和检测义务可延至2026年12月2日履行。

【参见：

https://digital-strategy.ec.europa.eu/en/faqs/transparency-obligations-under-article-50-ai-act】

European Commission Updates FAQs on Article 50 Transparency Obligations under the AI Act

Recently, the European Commission updated its FAQs on the transparency obligations under Article 50 of the AI Act, further clarifying the respective responsibilities of AI system providers and deployers and their application in specific scenarios. Providers must ensure that individuals are informed when interacting with an AI system and that AI-generated or manipulated content carries effective, reliable and interoperable machine-readable markings. Deployers must disclose the use of emotion-recognition and biometric-categorisation systems and clearly label deepfakes and AI-generated text on matters of public interest that has not undergone human review or editorial control. These obligations apply from August 2, 2026. For generative AI systems placed on the market before that date, compliance with the content-marking and detection obligation may be deferred until December 2, 2026.

[Reference:

https://digital-strategy.ec.europa.eu/en/faqs/transparency-obligations-under-article-50-ai-act]