Separate consent is a second, specific yes — not a longer privacy policy.
PIPL requires ‘separate consent’ for defined acts, including processing sensitive personal information, transferring PI abroad (unless another export tool and rule apply), disclosing PI, and some image/ID processing contexts. Separate means the individual can say yes to that act without swallowing the rest of the notice. A single ‘Agree’ on a 4,000-word policy is not separate consent. Where an export uses SCC/assessment, consent may still be needed for the processing — read the current measures; do not assume one filing replaces notice. Children’s consent is extra-strict.
4 questions before you choose the route.
This page identifies the right question and evidence. It does not determine the legal outcome on a reader’s facts.
Is the act on the separate-consent list?
SPI, export, public disclosure, others.
ActIs the UX actually separate?
Dedicated toggle or screen, not a buried clause.
UXIs another basis available?
Do not fake consent when a statutory basis fits better — but export/SPI still have extra gates.
BasisExport path in parallel?
SCC/assessment/certification sibling.
ExportWorking rule: Map the regulated role before marketing or launch in China.
The signal ledger.
These facts move the question beyond a label and into a product, money-flow and control analysis.
Bring a compact evidence docket—not a pitch deck.
Give a compliance team or counsel the operating facts that reveal the perimeter.
Questions people ask before they build.
Short answers for orientation. The right result can change with the service model and current rules.
Does SCC filing replace separate consent?
Not automatically. Filing is an export tool; individuals still need lawful processing and required consents.
Can we use click-wrap for SPI?
Only if the click is specific to that SPI purpose and informed. A general TOS click is not enough.
Primary authorities
Reviewed sources support orientation, not a fact-specific assessment.