PIPL: China's data law explained without complications

Give notice before processing

Before processing data, state in clear language who you are and how to contact you, the purposes, the methods, the types of data, the retention period and how to exercise rights. Google also requires the policy to say that third parties, such as Google, use cookies to show ads.

Explicit consent that is easy to withdraw

Consent must be voluntary, explicit and informed, and must be requested again if the purpose changes. The person can withdraw it, and the site must offer an easy way. With Google tags, Consent Mode can start as denied for China only.

gtag('consent', 'default', {
  'ad_storage': 'denied',
  'ad_user_data': 'denied',
  'ad_personalization': 'denied',
  'wait_for_update': 500,
  'region': ['CN']
});

Separate consent for partners

Before passing data to another processor, such as an ad partner, give their name and contact and ask for separate consent.

Option without personalization

Marketing done by automated decision must offer an option that does not use the visitor's personal characteristics or an easy way to refuse.

Sensitive data and children under 14

Sensitive data requires separate consent and an explanation of why it is needed. Data of children under 14 requires the consent of parents or guardians.

Transfer outside China

Say who receives the data abroad, the purpose and how to exercise rights, and ask for separate consent. Also use one of the paths in the law, such as a security assessment, certification or a standard contract.

Impact assessment

Do the assessment before processing sensitive data, using automated decisions, passing data to others or sending it abroad. Keep the report and the records for at least three years.

Representative in China

If the site is outside China and the law reaches it, set up an office or appoint a representative in the country and report the contacts to the authorities. Check with your legal team whether your site is covered.