Direct answer

Consent is one PIPL basis — bundled ‘I agree to everything’ is not consent.

PIPL allows processing on consent and on other statutory bases (contract necessity, statutory duties, HR/labour rules, public health, reasonable news reporting, and other conditions provided by law). Consent must be informed, voluntary and explicit, and people can withdraw it. Separate consent is a stricter sibling for SPI, export, public disclosure and similar gates. A privacy policy tick-box that bundles analytics, marketing and export is a classic failure. Do not copy GDPR ‘legitimate interests’ as a PIPL basis — it is not in the statute.

The classification screen

4 questions before you choose the route.

This page identifies the right question and evidence. It does not determine the legal outcome on a reader’s facts.

01

Which PIPL basis actually fits?

Consent vs contract vs HR vs legal duty.

Basis
02

Was it informed and unbundled?

Purpose-by-purpose, not a wall of text.

Quality
03

Can they withdraw?

Withdrawal must be as easy as giving consent.

Withdraw
04

Is separate consent required instead?

SPI, export, disclosure — sibling page.

Separate

Working rule: Map the regulated role before marketing or launch in China.

What changes the answer

The signal ledger.

These facts move the question beyond a label and into a product, money-flow and control analysis.

Signal
Ask the operating question
Why it changes the route
Legitimate interests paste
Did EU counsel paste LI into the China notice?
Not a PIPL basis.
Forced consent
Is access to the app blocked unless marketing is accepted?
Voluntariness fails.
HR consent only
Are you consenting employees for payroll?
HR processing often uses the labour-rules basis, not consent theatre.
Prepare before you escalate

Bring a compact evidence docket—not a pitch deck.

Give a compliance team or counsel the operating facts that reveal the perimeter.

01Notice textPurposes, types, retention, recipients.
02UX evidenceScreenshots of unbundled toggles.
03Withdrawal pathHow a user actually stops processing.
Common confusions

Questions people ask before they build.

Short answers for orientation. The right result can change with the service model and current rules.

Is consent always required?

No. Contract, HR and legal-duty bases exist. Misusing consent can be worse than using the right basis.

Does withdrawal mean delete everything?

Withdrawal stops processing based on consent. Other bases and legal holds can remain.

Primary authorities

Reviewed sources support orientation, not a fact-specific assessment.

PIPL (NPC / official text)
Cyberspace Administration of China
National laws database (NPC)
gov.cn policy releases