China: Nationwide PIPL Special Enforcement Actions Launched (April 2026)

On April 2, 2026, the Cyberspace Administration of China (CAC), together with the Ministry of Industry and Information Technology (MIIT) and the Ministry of Public Security (MPS), jointly announced a series of nationwide special enforcement actions targeting unlawful personal information processing. This marks a shift from rule-setting to operational enforcement across seven key sectors.

The campaign's architecture signals the CAC's new posture: "2026 is less about a sweeping crackdown and more about making compliance work in practice across industries." The defining features are sector-specific enforcement, product-level scrutiny (apps, SDKs, digital platforms), cross-agency coordination, and escalation to criminal enforcement for serious violations.

Six Target Areas and Their Implications for Foreign Businesses

Apps and SDKs: All apps operating in China and embedded SDKs (analytics, advertising, maps, push notifications). Foreign companies are liable even when violations originate in third-party SDKs. Required: comprehensive SDK inventory and data-flow audits.

Internet Advertising and Personalized Recommendation: Failure to disclose ad data usage, no functional opt-out from personalized ads, continuing collection after opt-out. Foreign brands relying on China-based ad-tech vendors face joint scrutiny.

Education Sector: Processing minors' data without guardian consent, forced facial recognition. Foreign education providers and corporate training platforms must establish standalone minors' data rules.

Transportation, Travel, and Logistics: Forced registration, excessive location tracking. Foreign companies integrating China-based logistics tools must apply strict data minimization.

Healthcare: Over-collection of location/identity data, inadequate encryption. Health data is sensitive PI under PIPL; penalties are heavier.

Financial Services: Collecting contacts, call logs, or SMS data; facial recognition as sole verification method. As the source notes:

"Foreign financial institutions operating in China are often caught between global group-level risk, fraud-control, or customer due diligence frameworks and China's stricter requirements on data minimization and purpose limitation."

A criminal enforcement track also targets data leaks, trafficking, insider misuse, and illegal commercialization.

The core message: "Regulators are increasingly concerned with whether PIPL principles, such as necessity, purpose limitation, and data minimization, are actually embedded in business operations, rather than merely reflected in policy documents."