China’s Personal Information Protection Law requires a personal information processor to identify a lawful basis and give required information to individuals before processing. Consent is one lawful basis, not the default answer for every activity. Where consent is used, it must be voluntary, explicit and given with full knowledge; individuals must be able to withdraw it conveniently.
A privacy notice and a consent action perform different functions. The notice explains who is processing which information, why and how, for how long, and how rights may be exercised. Consent records the individual’s choice where consent is the legal basis or a separate consent is required. A long policy and one bundled checkbox rarely provide a sound record for unrelated processing purposes.
Direct answer
Map each processing purpose to the correct PIPL basis before drafting the notice. Give the required information in a clear, accurate and accessible way before collection or other processing begins. If relying on consent, make the choice specific enough to be meaningful, avoid unnecessary bundling, retain evidence of the version and action, and provide a withdrawal route that is as practical as giving consent.
Do not ask for consent merely to create a document if another statutory basis actually supports the processing. Mislabeling the basis can make the notice inaccurate and create an expectation that all processing must stop when consent is withdrawn.
Lawful bases come first
PIPL permits processing in specified circumstances, including consent; necessity to conclude or perform a contract to which the individual is a party; necessity for human-resources management under lawfully formulated employment rules or collective contracts; performance of statutory duties or obligations; response to public-health emergencies or protection of life, health and property in an emergency; reasonable processing of information already made public; and other circumstances provided by law or administrative regulation.
There is no general “legitimate interests” basis equivalent to the GDPR formulation. Do not paste that label into a China notice. Record the actual PIPL basis for each purpose and reassess it when the purpose, data or recipients change.
What the notice should contain
Before processing, PIPL generally requires notice of the processor’s identity and contact details, purposes and methods, categories and retention period, and how individuals may exercise their rights. Other provisions add information for particular activities.
The notice should reflect actual systems and vendors. Avoid describing purposes so broadly that the reader cannot understand the intended use. Explain material automated decisions, sensitive information, public disclosure, third-party provision and overseas transfer through the applicable layer or just-in-time notice.
Where a law permits notice to be withheld or an emergency makes prior notice impracticable, document the basis and provide notice promptly when the statutory condition ends where required.
Clear, accessible and timely presentation
Use concise language, meaningful headings and a layered design. The first layer should communicate the decision-critical information; a fuller notice can provide detail. Just-in-time prompts are useful when activating a new feature, precise location, biometrics, marketing sharing or another unexpected use.
The notice must be available in a language and format the intended individuals can understand. Accessibility, mobile display and offline workforces matter. A link that is hidden, broken or shown only after collection does not establish effective prior notice.
Valid consent
When consent is the basis, the individual should know the relevant processing and make a voluntary, explicit choice. The processor bears the practical burden of showing what was presented and what action occurred.
Test whether access to a product, service or employment benefit is conditioned on consent to processing that is not necessary for that activity. PIPL restricts refusal of products or services solely because consent is withheld or withdrawn where the processing is unnecessary, subject to the statutory framework.
Silence, inactivity, preselected boxes or a general terms-of-service acceptance are weak designs for an affirmative PIPL consent. Match the mechanism to the data, purpose and risk.
Separate and written consent
PIPL requires separate consent for specified higher-risk activities. These include providing personal information to another processor, public disclosure, certain collection or use of images and identity information in public places, processing sensitive personal information, and providing personal information outside China, subject to the exact statutory conditions and any other lawful-basis analysis.
Separate consent should isolate the relevant decision rather than bury it in a general acceptance. The existing separate-consent guide remains the detailed owner of trigger-specific design.
Where law or administrative regulation requires written consent, use a form that can be retained and linked to the individual, notice, purpose and date. “Written” should not be assumed to require paper where a legally sufficient electronic record is available, but the applicable rule must be checked.
Sensitive personal information and minors
Sensitive personal information may cause serious harm to dignity, personal safety or property if leaked or misused. It may be processed only for a specific purpose and when sufficiently necessary, with strict protective measures. Additional notice must address necessity and impact, and separate consent is generally required.
For personal information of a minor under 14, PIPL treats the information as sensitive and requires consent from the parent or guardian, together with specific processing rules. Age-assurance and guardian-verification methods should be proportionate and should not collect excessive information.
The sensitive-information guide remains the owner of full classification, assessment and security analysis.
Changes to purpose or method
Consent covers the processing described when it was obtained. If the purpose, method or categories change beyond that scope, provide updated notice and obtain consent again where consent is required. Do not rely on a clause saying the company may change the policy at any time.
Use a change log and version-controlled approval process. Distinguish editorial clarifications from material changes requiring a new individual interaction.
Withdrawal and refusal
Provide a convenient way to withdraw consent. Withdrawal affects processing based on that consent from then onward but does not invalidate processing completed before withdrawal. Other data may still need to be retained or processed under another valid legal basis, such as a statutory retention obligation or dispute hold.
Explain the operational effect honestly. Route withdrawal to relevant systems and vendors, stop optional use, and record completion. Do not make the individual contact multiple unrelated teams if consent was given through one interface.
Rights and requests
The notice should explain the process for access, copying, correction, completion, deletion and other PIPL rights. Verify identity proportionately and track deadlines and outcomes under applicable rules. A processor should also explain a refusal where required and preserve the decision basis.
Rights routing must extend to vendors and data locations. A notice is not accurate if the organization cannot find or act on the data it describes.
Evidence and governance
Maintain:
- the data and purpose inventory;
- lawful-basis decisions;
- every notice and consent version with effective dates;
- interface screenshots or rendered copies;
- individual consent, refusal and withdrawal records;
- separate-consent and guardian-consent evidence;
- vendor and recipient mappings;
- change approvals and deployment logs;
- rights-request records; and
- assessment and audit material for high-risk processing.
The PIPL compliance-audit measures make these records operational audit evidence, not merely website copy.
Common mistakes
- Treating consent as the only PIPL lawful basis.
- Importing GDPR legitimate interests without a PIPL basis.
- Combining analytics, marketing, sensitive information and export in one checkbox.
- Giving notice after collection begins.
- Using an English-only notice for individuals who cannot understand it.
- Making withdrawal harder than consent.
- Treating withdrawal as requiring deletion despite a valid legal hold.
- Updating a privacy policy without versioning or reassessing consent.
Sources
- Personal Information Protection Law of the PRC, Cyberspace Administration of China.
- Personal Information Protection Compliance Audit Measures, Cyberspace Administration of China; effective 1 May 2025.
General legal information only; not legal advice for a particular notice, consent flow, data set, product or employment process.
