Separate Consent Under PIPL

Separate consent is a second, specific yes — not a longer privacy policy.

PIPL requires ‘separate consent’ for defined acts, including processing sensitive personal information, transferring PI abroad (unless another export tool and rule apply), disclosing PI, and some image/ID processing contexts. Separate means the individual can say yes to that act without swallowing the rest of the notice. A single ‘Agree’ on a 4,000-word policy is not separate consent. Where an export uses SCC/assessment, consent may still be needed for the processing — read the current measures; do not assume one filing replaces notice. Children’s consent is extra-strict.

The classification screen

4 questions before you choose the route.

This page identifies the right question and evidence. It does not determine the legal outcome on a reader’s facts.

Is the act on the separate-consent list?

SPI, export, public disclosure, others.

Act

Is the UX actually separate?

Dedicated toggle or screen, not a buried clause.

Is another basis available?

Do not fake consent when a statutory basis fits better — but export/SPI still have extra gates.

Basis

Export path in parallel?

Resolve the export path in parallel question separately before choosing the route.

Export

Working rule: PIPL requires ‘separate consent’ for defined acts, including processing sensitive personal information, transferring PI abroad (unless another export tool and rule apply), disclosing PI, and some image/ID processing contexts.

What changes the answer

The signal ledger.

These facts move the question beyond a label and into a product, money-flow and control analysis.

Signal

Ask the operating question

Why it changes the route

Same checkbox

Did marketing, SPI and export share one Agree?

That is the failure mode.

English-only notice

Are PRC users consenting in a language they do not read?

Informed consent fails.

Employee SPI

Is separate consent used to paper over a handbook gap?

HR SPI still needs necessity and PIA.

Prepare before you escalate

Bring a compact evidence docket—not a pitch deck.

Give a compliance team or counsel the operating facts that reveal the perimeter.

01Act listWhich processing needs a separate yes.

02ScreenshotsBefore/after of unbundled consent.

03Export fileWhether SCC/assessment is also in play.

Common confusions

Questions people ask before they build.

Short answers for orientation. The right result can change with the service model and current rules.

Does SCC filing replace separate consent?

Not automatically. Filing is an export tool; individuals still need lawful processing and required consents.

Can we use click-wrap for SPI?

Only if the click is specific to that SPI purpose and informed. A general TOS click is not enough.

Primary authorities

Reviewed sources support orientation, not a fact-specific assessment.

PIPL (NPC / official text)

Cyberspace Administration of China

National laws database (NPC)

Gov.cn policy releases