每周数据法律资讯 Data Law Weekly（20260914—20260920）

1.中央网信办发布关于30款App个人信息收集使用问题的通报

9月20日，中央网信办发布关于30款App个人信息收集使用问题的通报。所涉问题主要包括：未公开个人信息收集使用规则；频繁索要非必要权限；未逐一列出收集使用个人信息的SDK；未逐一列出收集使用个人信息的目的、方式、范围等；未提供有效账号注销功能。网信办要求相关App运营者应当于通报发布之日起的15个工作日内完成整改，并报送整改情况。网信办将会同有关部门进行核查，并结合整改情况依法依规开展处置处罚。

【参见：

https://mp.weixin.qq.com/s/zeoyJFc2LTvLRbawX_Sxkg】

The Cyberspace Administration of China Issues a Notice Regarding Issues with the Collection and Use of Personal Information by 30 Apps

On September 20, the Cyberspace Administration of China issued a notice regarding issues with the collection and use of personal information by 30 apps. The main issues include: failure to disclose rules governing the collection and use of personal information; frequent requests for non-essential permissions; failure to list, one by one, the SDKs used to collect and use personal information; failure to list, one by one, the purposes, methods, and scope of personal information collection and use; and failure to provide an effective account deletion function. The Cyberspace Administration requires the relevant app operators to complete corrective actions within 15 business days from the date of the notice’s issuance and to submit a report on the status of those actions. The Cyberspace Administration will conduct verification in conjunction with relevant departments and, based on the results of the corrective actions, take appropriate measures and impose penalties in accordance with laws and regulations.

[Reference:

https://mp.weixin.qq.com/s/zeoyJFc2LTvLRbawX_Sxkg]

2.国家网信办就《国务院关于保障未成年人健康安全使用网络的规定（征求意见稿）》公开征求意见

9月18日，国家网信办就《国务院关于保障未成年人健康安全使用网络的规定（征求意见稿）》公开征求意见。规定共25条，主要内容包括：要求网络服务提供者、智能终端产品制造者、应用程序分发平台落实未成年人模式；限制向未成年人提供陌生人网络社交、虚拟亲密关系等网络服务，并要求向未满16周岁未成年人提供网络音视频、网络游戏、网络社交等服务时通过未成年人模式提供；要求网络服务提供者具备未成年人用户识别能力，保障未成年人个人信息安全，并加强未成年人模式下信息内容和算法管理；要求智能终端设置未成年人模式联动、一键切换、退出核验、防绕过等功能；同时明确相关部门、学校及监护人的未成年人网络保护责任和法律责任。

【参见：

https://mp.weixin.qq.com/s/sZiYr-IwKx_9jHZRK-6ThA】
 

CAC Seeks Public Comments on the “Provisions of the State Council on Safeguarding Minors’ Healthy and Safe Use of the Internet (Draft for Comment)”

On September 18, the CAC sought public comments on the “Provisions of the State Council on Safeguarding Minors’ Healthy and Safe Use of the Internet (Draft for Comment).” The 25-article draft requires network service providers, smart terminal manufacturers, and app distribution platforms to implement minor mode; restricts online services such as social networking with strangers and virtual intimate relationships for minors; and requires online audiovisual, online gaming, and online social networking services provided to minors under 16 to be offered through minor mode. It also requires network service providers to identify minor users, protect minors’ personal information, and strengthen content and algorithm management under minor mode. Smart terminals are required to provide functions such as linked activation, one-click switching, exit verification, and anti-circumvention. The draft also clarifies the responsibilities and legal liabilities of relevant authorities, schools, and guardians for protecting minors online.

[Reference:

https://mp.weixin.qq.com/s/sZiYr-IwKx_9jHZRK-6ThA]
 

3.国家网信办发布《关于加强涉企侵权信息管理 持续推动营商网络环境优化的通知》

9月18日，国家网信办发布《关于加强涉企侵权信息管理持续推动营商网络环境优化的通知》，要求网站平台压实信息内容管理主体责任，健全涉企信息事前审核、事中巡查、事后处置全链条管理机制，主动清理涉企侵权信息。通知明确涉企侵权信息包括个人信息类、侮辱贬损类、假冒仿冒类、虚假误导类和其他类，其中个人信息类涉及企业家身份及联系信息、生物识别、医疗健康、金融账户、行踪轨迹等敏感个人信息；同时要求网站平台将涉企信息纳入日常内容审核处置范围，强化账号、MCN机构管理，对涉企侵权信息及时清理处置。

【参见：

https://mp.weixin.qq.com/s/7KgNU4Cc7SyNs_OJyHW4zg?scene=1&click_id=571553191】
 

CAC Issues the “Notice on Strengthening the Management of Information Infringing upon Enterprises and Continuously Optimizing the Online Business Environment”

On September 18, the CAC issued the “Notice on Strengthening the Management of Information Infringing upon Enterprises and Continuously Optimizing the Online Business Environment.” The Notice requires online platforms to strengthen their primary responsibility for content management and establish a full-chain mechanism covering prior review, ongoing monitoring, and post-event handling of enterprise-related information. It identifies infringing information concerning enterprises as including personal information, insulting or derogatory information, impersonation or counterfeiting, false or misleading information, and other categories. The personal information category covers sensitive personal information such as entrepreneurs’ identity and contact information, biometric information, medical and health information, financial account information, and location or movement information. Platforms are also required to incorporate enterprise-related information into their routine content review and handling processes, strengthen account and MCN agency management, and promptly remove or otherwise handle infringing information concerning enterprises.

[Reference:

https://mp.weixin.qq.com/s/7KgNU4Cc7SyNs_OJyHW4zg?scene=1&click_id=571553191]
 

4.全国网安标委就《网络安全标准实践指南——智能体系统开发安全指南（征求意见稿）》公开征求意见

9月18日，全国网络安全标准化技术委员会秘书处就《网络安全标准实践指南——智能体系统开发安全指南（征求意见稿）》公开征求意见。该指南围绕大模型智能体需求设计、代码开发、测试上线等全生命周期提出安全管控要求，重点关注工具调用越权、提示注入、数据泄露等风险，为企业开展智能体系统安全开发提供标准化安全基线。

【参见：

https://mp.weixin.qq.com/s/sPyvZlEpyHa3SGvonIPTaQ?scene=1&click_id=206052711】
 

TC260 Seeks Public Comments on the “Cybersecurity Standard Practice Guide-Security Guidelines for Agent System Development (Draft for Comment)”

On September 18, the Secretariat of the National Technical Committee 260 on Cybersecurity of SAC sought public comments on the “Cybersecurity Standard Practice Guide-Security Guidelines for Agent System Development (Draft for Comment).” The Guide sets out security management requirements covering the full lifecycle of large-model agent systems, including requirements design, code development, testing, and deployment. It focuses on risks such as unauthorized tool invocation, prompt injection, and data leakage, providing a standardized security baseline for organizations developing agent systems.

[Reference:

https://mp.weixin.qq.com/s/sPyvZlEpyHa3SGvonIPTaQ?scene=1&click_id=206052711]
 

5.《电子产品信息清除技术要求》配套3项标准实践指南正式发布

9月15日，在2026年国家网络安全宣传周电子产品信息清除分论坛上，《半导体存储介质块擦除技术指引》《电子产品回收过程中的信息清除管理指引》《移动智能终端信息清除技术指引》3项网络安全标准实践指南正式发布。三项指南用于配套GB 46864-2025《数据安全技术电子产品信息清除技术要求》实施，分别明确半导体存储介质块擦除的实现方法和操作指令、电子产品回收过程中的信息清除日志及标识管理要求，以及手机、平板电脑等移动智能终端信息清除的具体方法、操作过程和验证要求。

【参见：

https://mp.weixin.qq.com/s/ZhdRrHrxHJTj2Jzot6iO0g】
 

Three Supporting Cybersecurity Standard Practice Guides for the “Technical Requirements for Information Erasure of Electronic Products” Are Officially Released

On September 15, three supporting cybersecurity standard practice guides were officially released at a sub-forum on information erasure of electronic products during the 2026 National Cybersecurity Awareness Week. The three guides support the implementation of GB 46864-2025, “Data Security Technology-Technical Requirements for Information Erasure of Electronic Products.” They respectively specify implementation methods and operating commands for block erasure of semiconductor storage media, requirements for information erasure logs and labeling during electronic product recycling, and specific methods, procedures, and verification requirements for information erasure on mobile smart terminals such as smartphones and tablets.

[Reference:

https://mp.weixin.qq.com/s/ZhdRrHrxHJTj2Jzot6iO0g]
 

6.国家网信办发布网络安全、数据安全、个人信息保护等领域执法典型案例

9月15日，国家网信办发布网络安全、数据安全、个人信息保护等领域执法典型案例，通报10起典型案件。主要问题包括：未履行网络安全保护义务、设置恶意程序，存在数据和个人信息泄露风险；超范围收集非必要个人信息、违法收集使用人脸信息、违法向境外传输个人信息；以及未按规定落实人工智能生成合成内容标识、安全评估等要求。相关网信部门已依法采取责令整改、警告、罚款、下线等措施，并对涉嫌违法犯罪问题移送公安机关。

【参见：

https://mp.weixin.qq.com/s/S-f_K96o3axIYZtxT5sAdQ?scene=1&click_id=683516119】
 

CAC Publishes Typical Enforcement Cases in the Fields of Cybersecurity, Data Security and Personal Information Protection

On September 15, the CAC published 10 typical enforcement cases involving cybersecurity, data security, and personal information protection. The cases involved failures to fulfill cybersecurity protection obligations, the installation of malicious programs, risks of data and personal information leakage, excessive collection of unnecessary personal information, unlawful collection and use of facial information, unlawful cross-border transfers of personal information, and failures to comply with requirements for labeling AI-generated or synthesized content and conducting security assessments. Relevant cyberspace authorities took measures including orders for rectification, warnings, fines, and takedowns, and referred suspected criminal matters to public security authorities.

[Reference:

https://mp.weixin.qq.com/s/S-f_K96o3axIYZtxT5sAdQ?scene=1&click_id=683516119]

7.全国网络安全标准化技术委员会发布《网络安全标准实践指南——座舱数据处理安全要求》

9月15日，全国网络安全标准化技术委员会（TC260）发布《网络安全标准实践指南——座舱数据处理安全要求》，针对智能座舱场景下的数据处理活动提出细化安全要求。主要内容包括：明确座舱数据范围及座舱数据处理者；原则上要求座舱数据“不出车”，驾驶员状态监测涉及的人脸数据应在车内处理，确需出车处理的语音数据应先在车端匿名化；处理座舱数据中的敏感个人信息应取得个人单独同意；对语音唤醒、智能语音对话、驾驶员状态监测、远程查看等功能提出数据收集、存储、传输及用户提示要求；同时要求汽车制造商掌握零部件及车载应用的数据收集、传输情况，并通过合同约束和监督供应商的数据处理行为。

【参见：

https://www.tc260.org.cn/tc260/tzgg/202609/4a537d5ca4d548ec9e2a000bad2e895d.shtml】
 

TC260 Issues the “Cybersecurity Standard Practice Guide-Security Requirements for In-Vehicle Cabin Data Processing”

On September 15, the National Technical Committee 260 on Cybersecurity of SAC issued the “Cybersecurity Standard Practice Guide-Security Requirements for In-Vehicle Cabin Data Processing,” setting out detailed security requirements for data processing in intelligent vehicle cockpit scenarios. The Guide defines the scope of cabin data and cabin data processors and, in principle, requires cabin data to remain within the vehicle. Facial data used for driver status monitoring should be processed within the vehicle, while voice data that must be processed outside the vehicle should first be anonymized on the vehicle side. Separate consent is required for processing sensitive personal information contained in cabin data. The Guide also establishes requirements for data collection, storage, transmission, and user notification in functions such as voice wake-up, intelligent voice interaction, driver status monitoring, and remote viewing. Vehicle manufacturers are required to understand data collection and transmission by component suppliers and in-vehicle applications and to constrain and supervise suppliers’ data processing activities through contracts.

[Reference:

https://www.tc260.org.cn/tc260/tzgg/202609/4a537d5ca4d548ec9e2a000bad2e895d.shtml]
 

8.全国网安标委发布《人工智能应用安全指引总则》等4项网安标准实践指南

9月15日，全国网络安全标准化技术委员会发布《人工智能应用安全指引总则》等4项网络安全标准实践指南，以有效应对人工智能快速发展应用带来的新风险新挑战。该系列文件包括通用文件和行业领域文件两类，其中《总则》为通用文件，适用于各行业领域开展人工智能应用活动；《教育》《卫生健康》《广播电视和网络视听》3项为行业领域文件，为特定行业领域开展人工智能应用活动提供针对性安全指导。

【参见：

https://mp.weixin.qq.com/s/QC1f7mHSAPAh-SqZvVb9hQ】
 

TC260 Issues Four Cybersecurity Standard Practice Guides, Including the “General Guidelines for AI Application Security”

On September 15, the National Technical Committee 260 on Cybersecurity of SAC issued four cybersecurity standard practice guides, including the “General Guidelines for AI Application Security,” to address new risks and challenges arising from the rapid development and application of artificial intelligence. The series consists of a general guide and three sector-specific guides covering education, healthcare, and radio, television, and online audiovisual services. The “General Guidelines” apply to AI application activities across industries, while the three sector-specific guides provide targeted security guidance for their respective fields.

[Reference:

https://mp.weixin.qq.com/s/QC1f7mHSAPAh-SqZvVb9hQ]

9.《人工智能安全治理框架3.0》发布

9月14日，在2026年国家网络安全宣传周开幕式上，全国网络安全标准化技术委员会发布《人工智能安全治理框架3.0》。该框架延续“风险分类、技术应对、综合治理”的核心逻辑，与时俱进更新人工智能风险分类，优化调整技术应对和综合治理措施，旨在提升人工智能安全治理共识和风险防范应对能力，促进人工智能技术安全发展。

【参见：

https://mp.weixin.qq.com/s/Hjxc5fhSknCCMjixwj0hlw】

The “Artificial Intelligence Security Governance Framework 3.0” Is Released

On September 14, at the opening ceremony of the 2026 National Cybersecurity Awareness Week, the National Technical Committee 260 on Cybersecurity of SAC released the “Artificial Intelligence Security Governance Framework 3.0.” The Framework retains the core approach of “risk classification, technical response, and comprehensive governance,” while updating the classification of AI risks and optimizing technical response and comprehensive governance measures. It aims to strengthen consensus on AI security governance and enhance risk prevention and response capabilities, thereby promoting the secure development of AI technologies.

[Reference:

https://mp.weixin.qq.com/s/Hjxc5fhSknCCMjixwj0hlw]
 

10.国家网信办发布2026年8月生成式人工智能服务已备案信息

近期，国家网信办发布2026年8月生成式人工智能服务已备案信息。根据公告，网信部门会同相关部门依据《生成式人工智能服务管理暂行办法》持续开展生成式人工智能服务备案工作，并定期汇总更新已备案信息。已上线的生成式人工智能应用或功能，应在显著位置或产品详情页面公示所使用的已备案生成式人工智能服务，并注明模型名称及备案号。提供具有舆论属性或者社会动员能力的生成式人工智能服务的，可通过属地网信部门履行备案程序。

【参见：

https://www.cac.gov.cn/2024-04/02/c_1713729983803145.htm】

CAC Publishes Information on Generative Artificial Intelligence Services Filed in August 2026

Recently, the CAC published information on generative artificial intelligence services filed in August 2026. According to the announcement, the cyberspace authorities, together with relevant departments, continue to carry out filing of generative AI services in accordance with the “Interim Measures for the Management of Generative Artificial Intelligence Services” and regularly update information on filed services. Generative AI applications or functions that have been launched should prominently disclose the filed generative AI service used, including the model name and filing number. Providers of generative AI services with public opinion or social mobilization attributes may complete the filing procedure through the local cyberspace administration authority.

[Reference:

https://www.cac.gov.cn/2024-04/02/c_1713729983803145.htm]
 

11.合肥市网信办依法处置一起未履行个人信息保护义务案件

近日，合肥市网信办依法处置一起未履行未成年人个人信息保护义务案件。经调查，属地“某蛙”APP处理不满十四周岁未成年人个人信息，未制定专门的个人信息处理规则，违反《中华人民共和国个人信息保护法》第三十一条规定。9月3日，合肥市网信办责令相关单位改正，并依据《中华人民共和国个人信息保护法》第六十六条第一款规定，对其作出警告的行政处罚。

【参见：

https://mp.weixin.qq.com/s/2cpCC03fP0RHr40Z-CoduQ?scene=1&click_id=1354591834】
 

Hefei Cyberspace Administration Lawfully Handles a Case Involving Failure to Fulfill Personal Information Protection Obligations

Recently, the Hefei Cyberspace Administration lawfully handled a case involving failure to fulfill personal information protection obligations concerning minors. The investigation found that a local app processed the personal information of minors under the age of 14 without formulating specific personal information processing rules, in violation of Article 31 of the Personal Information Protection Law of the People’s Republic of China. On September 3, the Hefei Cyberspace Administration ordered the relevant entity to make corrections and, pursuant to Paragraph 1 of Article 66 of the Personal Information Protection Law of the People’s Republic of China, issued an administrative warning.

[Reference:

https://mp.weixin.qq.com/s/2cpCC03fP0RHr40Z-CoduQ?scene=1&click_id=1354591834]
 

12.湖南省网信办依法约谈7家大模型运营单位

近期，湖南省网信办巡查发现，某科技有限公司等7家大模型运营单位存在生成式人工智能信息安全问题，违反《中华人民共和国网络安全法》《生成式人工智能服务管理暂行办法》等相关规定。湖南省网信办依法约谈相关单位负责人，责令限期整改，排查信息安全围栏漏洞并落实整改措施。目前，5家单位已完成整改，2家单位自行对相关大模型采取下线处置。

【参见：

https://mp.weixin.qq.com/s/4KqcRVTFZDBmV9ESXIszWQ】
 

Hunan Cyberspace Administration Conducts Regulatory Meetings with Seven Large Model Operators

Recently, the Hunan Cyberspace Administration found during inspections that seven large model operators, including a technology company, had information security issues involving generative artificial intelligence, in violation of relevant provisions of the Cybersecurity Law of the People’s Republic of China and the “Interim Measures for the Management of Generative Artificial Intelligence Services.” The Hunan Cyberspace Administration conducted regulatory meetings with the relevant entities, ordered them to complete rectification within a specified period, identify vulnerabilities in their information security safeguards, and implement corrective measures. To date, five entities have completed rectification, while two have independently taken their relevant large models offline.

[Reference:

https://mp.weixin.qq.com/s/4KqcRVTFZDBmV9ESXIszWQ]

1.欧盟委员会提出《儿童安全法案》，拟将社交媒体开户年龄统一设定为15岁

9月17日，欧盟委员会提出《欧盟儿童法案》（EU KIDS Act）条例提案，拟在全欧盟将社交网络服务和视频分享平台的自主开户年龄统一设定为15岁，并对社交网络、视频分享平台、网络游戏、人工智能陪伴系统、聊天机器人和应用商店规定安全设计义务。提案主要内容包括：限制未满15岁未成年人自主开户，允许13至15岁未成年人在监护人控制下使用受限账户；限制自动播放、连续内容消费、个性化推荐等可能助长过度使用的设计；要求人工智能陪伴系统和聊天机器人避免造成情感依赖的设计；要求应用商店建立年龄分级制度；同时建立统一的年龄保障规则，要求年龄保障措施符合数据最小化、隐私保护等要求。

【参见：

https://digital-strategy.ec.europa.eu/en/library/proposal-eu-kids-act-eu-keeping-internet-digital-spaces-accountable-and-trustworthy】
 

European Commission Proposes the “EU KIDS Act” to Set the Minimum Age for Independent Social Media Accounts at 15

On September 17, the European Commission proposed the “EU KIDS Act,” which would establish 15 as the minimum age for independently opening accounts on social networking services and video-sharing platforms across the EU. The proposal would also introduce safety-by-design obligations for social networks, video-sharing platforms, online games, AI companion systems, chatbots, and app stores. Key measures include restricting independent account creation by children under 15 while allowing those aged 13 to 15 to use restricted accounts under parental control; limiting features such as autoplay, continuous content consumption, and personalized recommendations that may encourage excessive use; requiring AI companion systems and chatbots to avoid designs that may foster emotional dependency; requiring app stores to establish age-rating systems; and introducing common age-assurance rules that comply with data minimization and privacy protection requirements.

[Reference:

https://digital-strategy.ec.europa.eu/en/library/proposal-eu-kids-act-eu-keeping-internet-digital-spaces-accountable-and-trustworthy]
 

2.韩国要求OpenAI、DeepSeek等5家公司整改个人信息保护问题

9月16日，韩国个人信息保护委员会公布2025年个人信息处理政策评估后续检查结果，对OpenAI、DeepSeek、特斯拉韩国、Nike、Wrtn等5家公司提出改善建议。主要问题包括：未实际回复用户提出的个人信息权利行使请求，或分别以英语、中文回复韩国用户；韩国境内代理人提供的咨询邮箱未实际回复用户咨询；以及个人信息处理政策记载的处理依据与实际处理方式不一致、访问路径复杂、未公开历史版本等。委员会要求相关企业完善个人信息权利行使和韩国境内代理人运营机制，确保相关渠道能够实际受理和处理用户请求。

【参见：

https://pipc.go.kr/np/cop/bbs/selectBoardArticle.do?bbsId=BS074&mCode=C020010000&nttId=12499】
 

Korea Requires OpenAI, DeepSeek and Three Other Companies to Improve Personal Information Protection Practices

On September 16, the Personal Information Protection Commission of Korea announced the results of follow-up inspections following its 2025 assessment of personal information processing policies and issued improvement recommendations to five companies, including OpenAI, DeepSeek, Tesla Korea, Nike, and Wrtn. The identified issues included failure to actually respond to users’ requests to exercise their personal information rights, or responding to Korean users in English or Chinese; failure of the email addresses provided by Korean representatives to respond to inquiries; inconsistencies between the processing grounds stated in personal information processing policies and actual processing practices; complicated access procedures; and failure to disclose previous versions of such policies. The Commission requested the companies to improve their mechanisms for handling personal information rights requests and operating local representatives, ensuring that relevant channels can effectively receive and process users’ requests.

[Reference:

https://pipc.go.kr/np/cop/bbs/selectBoardArticle.do?bbsId=BS074&mCode=C020010000&nttId=12499]