每周数据法律资讯 Data Law Weekly（20260831—20260906）

1.上海市网信办关于属地App个人信息收集使用问题的通报（2026年第五批-未成年人保护专项）

9月4日，上海市网信办发布2026年第五批属地App个人信息收集使用问题（未成年人保护专项），对属地App、小程序等服务产品收集使用个人信息行为进行检测。相关运营者应于通报发布之日起15个工作日内完成整改并报送整改情况，对整改不到位的，将依法依规开展处置处罚。检测到的主要问题包括：收集敏感个人信息未同步告知目的及必要性、处理敏感个人信息未取得个人的单独同意、频繁征求用户同意收集个人信息、在无关场景收集位置、通讯录、短信等个人信息、注销后未及时删除个人信息、为注销用户账号设置不必要或不合理条件、首次启动未提示用户阅读隐私政策、未针对不满十四周岁未成年人制定专门的个人信息处理规则、未及时响应个人信息权益诉求、超出最低必要频率调用个人信息权限等。

【参见：

https://mp.weixin.qq.com/s/wbtKHL1RFVI4iRMjdrSH1g】

Shanghai Cyberspace Administration Issues Notice on Personal Information Collection and Use by Local Apps (2026, Fifth Batch-Special Campaign on the Protection of Minors)

On September 4, the Shanghai Cyberspace Administration issued a notice on the fifth batch of personal information collection and use issues involving local Apps in 2026 (Special Campaign on the Protection of Minors), following inspections of personal information collection and use by local Apps, mini programs and other service products. Relevant operators are required to complete rectification and report the rectification results within 15 working days from the date of the notice, and those failing to complete rectification as required will be subject to regulatory measures and penalties in accordance with law. The main issues identified include failure to simultaneously inform users of the purpose and necessity when collecting sensitive personal information, failure to obtain separate consent when processing sensitive personal information, frequent requests for user consent to collect personal information, collection of location, contacts, SMS and other personal information in unrelated scenarios, failure to promptly delete personal information after account cancellation, imposition of unnecessary or unreasonable conditions for account cancellation, failure to prompt users to read the privacy policy upon first launch, failure to formulate dedicated personal information processing rules for minors under 14, failure to respond to requests concerning personal information rights in a timely manner, and calling personal information permissions more frequently than minimally necessary.

[Reference:

https://mp.weixin.qq.com/s/wbtKHL1RFVI4iRMjdrSH1g]

2.中央网信办深入开展“清朗·整治AI应用乱象”专项行动第二阶段工作

9月2日，中央网信办通报“清朗·整治AI应用乱象”专项行动第二阶段工作进展，聚焦利用AI制作发布虚假信息、传播暴力低俗内容、假冒仿冒他人、侵害未成年人权益等突出问题，督促网站平台持续加强AI生成合成内容管理，完善信息审核、账号管理和应用程序治理机制，集中清理违法不良信息。截至目前，累计清理违法违规信息561万余条，查处账号4.9万余个，处置违规网站、应用程序等2400余个。专项行动期间，一批违法违规账号和应用受到处理，典型案例涵盖利用AI“魔改”经典、生成低质内容，制作发布虚假不实信息，假冒仿冒他人，制作发布暴力低俗信息，侵害未成年人权益，利用AI“托管”从事网络水军活动，以及AI产品服务和应用程序违规等问题。

【参见：

https://mp.weixin.qq.com/s/ebTj7UhKU7e9stgAAP7f-A】

CAC Deepens the Second Phase of the “Qinglang Campaign-Campaign to Address AI Application-Related Problems”

On September 2, CAC reported on the progress of the second phase of the “Qinglang Campaign-Campaign to Address AI Application-Related Problems”, focusing on prominent issues including the use of AI to produce and disseminate false information, spread violent or vulgar content, impersonate or imitate others, and infringe upon the rights and interests of minors. CAC urged websites and platforms to further strengthen the management of AI-generated and synthetic content, improve information review, account management and application governance mechanisms, and intensify the removal of illegal and harmful information. As of now, more than 5.61 million pieces of illegal or non-compliant information have been removed, more than 49,000 accounts have been handled, and more than 2,400 non-compliant websites and applications have been disposed of. During the campaign, a number of non-compliant accounts and applications were handled, with typical cases involving the use of AI to modify classic works and generate low-quality content, the production and dissemination of false information, impersonation or imitation of others, the production and dissemination of violent or vulgar content, infringement of minors’ rights and interests, the use of AI “managed accounts” for online astroturfing, and violations involving AI products, services and applications.

[Reference:

https://mp.weixin.qq.com/s/ebTj7UhKU7e9stgAAP7f-A]

3.安徽省通信管理局关于侵害用户权益APP的通报（2026年第6批）

9月2日，安徽省通信管理局通报2026年第6批侵害用户权益APP，经拨测检查发现25款APP存在违法违规收集使用个人信息问题，并于7月24日向相关APP开发者下达责令改正通知书。截至目前，仍有8款APP未完成整改，相关开发者应于9月7日前落实整改要求，逾期不整改的，将依法依规开展处置。主要问题包括：违规收集个人信息、超范围收集个人信息、强制、频繁、过度索取权限等。

【参见：

https://mp.weixin.qq.com/s/C4YWbxmOaLb-3WDNiLL3Zw】
 

Anhui Communications Administration Issues Notice on Apps Violating Users’ Rights and Interests (2026, Sixth Batch)

On September 2, the Anhui Communications Administration issued a notice on the sixth batch of Apps violating users’ rights and interests in 2026.Following testing,25 Apps were found to have illegally or improperly collected and used personal information, and rectification notices were issued to the relevant App developers on July 24.As of now,8 Apps have yet to complete rectification. The relevant developers are required to complete rectification by September 7, and those failing to do so will be subject to regulatory measures in accordance with law. The main issues include illegal collection of personal information, collection of personal information beyond the necessary scope, and forced, frequent or excessive requests for permissions.

[Reference:

https://mp.weixin.qq.com/s/C4YWbxmOaLb-3WDNiLL3Zw]
 

4.上海市通信管理局开展金融领域APP（SDK）侵害用户权益行为专项整治

9月1日，上海市通信管理局联合上海金融监管局开展金融领域APP（SDK）侵害用户权益行为专项整治，覆盖银行、保险、汽车金融等金融机构，共发现52款APP（SDK）存在侵害用户权益问题，主要涉及未明示个人信息处理规则、违规收集个人信息、未妥善处理用户投诉等七大类问题。上海市通信管理局要求相关金融机构提高思想认识、压实主体责任、严守合规经营底线，全面开展自查自纠并落实问题整改；同时建立健全常态化合规治理、自查复盘与风险管控机制，持续加强APP用户权益保护。

【参见：

https://mp.weixin.qq.com/s/E39q51hSY2wqKOuJGHEAvA】
 

Shanghai Communications Administration Launches Special Campaign to Address Violations of Users’ Rights and Interests by Financial Sector Apps (SDKs)

On September 1, the Shanghai Communications Administration, jointly with the Shanghai Financial Regulatory Bureau, launched a special campaign to address violations of users’ rights and interests by Apps (SDKs) in the financial sector. The campaign covers banking, insurance, automotive finance and other financial institutions, and identified 52 Apps (SDKs) involving violations of users’ rights and interests. The main issues fall into seven categories, including failure to clearly disclose personal information processing rules, illegal collection of personal information, and failure to properly handle user complaints. The Shanghai Communications Administration required relevant financial institutions to raise awareness, strengthen their primary responsibilities and adhere to compliance requirements, conduct comprehensive self-inspections and implement rectification measures, and establish regular compliance governance, self-review and risk management mechanisms to continuously strengthen the protection of App users’ rights and interests.

[Reference:

https://mp.weixin.qq.com/s/E39q51hSY2wqKOuJGHEAvA]
 

5.公安部计算机信息系统安全产品质量监督检验中心检测发现42款违法违规收集使用个人信息的移动应用

9月1日，公安部计算机信息系统安全产品质量监督检验中心通报42款存在违法违规收集使用个人信息情况的移动应用，主要问题包括：未公开个人信息收集使用规则、未经用户同意收集使用个人信息、未完整准确告知个人信息收集使用情况或实际收集使用情况与告知内容不一致、未列明向第三方提供个人信息的相关信息、申请个人信息权限或收集个人敏感信息时未同步告知目的、超出必要范围收集使用个人信息、未提供有效注销账号功能，以及未建立、公布个人信息安全投诉举报渠道等。另有上期通报的35款移动应用经复测仍有5款存在问题，相关移动应用分发平台已予以下架。

【参见：

https://mp.weixin.qq.com/s/H5B8TEKAcvoh1v4nqPf1_A】

1.美国16州总检察长因AI模型数据安全事件对OpenAI启动调查

9月1日，蒙大拿州总检察长Austin Knudsen宣布，其与其他15个州总检察长对OpenAI启动调查，以确定其是否因实验性AI模型引发的数据安全事件违反消费者保护及数据隐私法律。据监管机构称，今年7月，OpenAI一款实验性AI模型在测试过程中未经授权访问多个计算机网络，并对AI平台Hugging Face实施入侵。蒙大拿州总检察长已要求OpenAI提供与事件有关的材料和数据，并在能够证明具备充分人工监督及安全措施前停止相关测试。OpenAI应于9月12日前作出回应。

【参见：

https://dojmt.gov/?p=96957&utm】

16 U.S. State Attorneys General Launch Investigation into OpenAI over AI Model Data Security Incident

On September 1, Montana Attorney General Austin Knudsen announced that he and 15 other state attorneys general had launched an investigation into OpenAI over potential violations of consumer protection and data privacy laws. According to the regulators, an experimental OpenAI model allegedly gained unauthorized access to several computer networks, including Hugging Face, during testing in July. Montana has demanded relevant materials and data and called for the related testing to cease until adequate human oversight and safety safeguards can be demonstrated. OpenAI has until September 12 to respond.

[Reference:

https://dojmt.gov/?p=96957&utm]

2.欧盟委员会将ChatGPT指定为“超大型在线搜索引擎”（VLOSE）

8月31日，欧盟委员会依据《数字服务法》（DSA）将ChatGPT指定为“超大型在线搜索引擎”（VLOSE）。欧盟委员会认为，ChatGPT能够响应用户查询并联网搜索，属于DSA项下的在线搜索引擎；相关服务方声明其在欧盟的月均用户数达到4500万以上，符合VLOSE指定门槛。根据指定要求，ChatGPT须在指定通知后四个月内履行相关额外义务，包括评估和缓解非法内容传播、未成年人保护、用户身心健康、基本权利、选举程序及公共安全等系统性风险；欧盟委员会也将加强对其服务及算法系统的监督，并与爱尔兰数字服务协调机构合作开展监管。

【参见：

https://ec.europa.eu/commission/presscorner/detail/en/ip_26_1772】

European Commission Designates ChatGPT as a “Very Large Online Search Engine” (VLOSE)

On August 31, the European Commission designated ChatGPT as a “Very Large Online Search Engine” (VLOSE) under the Digital Services Act (DSA). The European Commission considers ChatGPT an online search engine under the DSA because it can respond to user queries and conduct searches online. The relevant service provider declared that its average monthly users in the EU exceeded 45 million, meeting the threshold for VLOSE designation. Following the designation, ChatGPT must comply with additional obligations within four months, including assessing and mitigating systemic risks related to the dissemination of illegal content, the protection of minors, users’ physical and mental well-being, fundamental rights, electoral processes and public security. The European Commission will also strengthen oversight of the service and its algorithmic systems and cooperate with Ireland’s Digital Services Coordinator in regulatory supervision.

[Reference:

https://ec.europa.eu/commission/presscorner/detail/en/ip_26_1772]
 

3.加利福尼亚州参议院修订AB 2246法案，强化儿童网络隐私和安全保护

近日，加利福尼亚州参议院修订AB 2246法案。该法案拟重构现行《加州适龄设计规范法》（California Age-Appropriate Design Code Act），要求可能被儿童访问的在线服务、产品或功能采取年龄估计或向所有用户适用儿童保护措施，默认提供高水平隐私保护，并限制对儿童进行画像、非必要个人信息处理、精准地理位置收集及暗黑模式设计。同时，企业还需采取合理措施防范可能对儿童造成的身体、经济、严重心理或情绪、隐私及歧视风险。违法行为最高可分别按每名受影响儿童处以5,000美元（过失）或15,000美元（故意）的民事罚款。此后，该法案已获参众两院通过，并于9月3日进入正式登记（enrolled）阶段。

【参见：

https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260AB2246&utm】

California Senate Amends AB 2246 to Strengthen Children’s Online Privacy and Safety

Recently, the California Senate amended AB 2246, which would overhaul the California Age-Appropriate Design Code Act. The bill would require online services, products, or features likely to be accessed by children to implement age estimation or extend children’s protections to all users, provide high-privacy defaults, and restrict profiling, unnecessary data processing, precise geolocation collection, and dark patterns involving children. Businesses would also be required to take reasonable steps to prevent specified physical, financial, psychological, privacy, and discrimination-related harms to children. Violations could result in civil penalties of up to USD 5,000 per affected child for negligent violations and USD 15,000 for intentional violations. The bill subsequently passed both chambers and was enrolled on September 3.

[Reference:

https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260AB2246&utm]