Only collect personal data strictly necessary for the app’s operation; consent from guardians is required for users under 14, and the privacy policy must be clearly written

Cost: No cost involved. Before launch, cross‑check the list of permissions the app requests against the privacy policy and remove any unnecessary permissions. The main challenge is that product teams often want to retain data “just in case it might be useful later.”

In plain terms: Only gather information that is genuinely needed for business purposes, and obtain consent from a guardian for any user under 14. For violations, regulators first order corrections and issue warnings, and may also confiscate illegal earnings; the app can be ordered to suspend or terminate its services. If the violation persists, fines up to 1 million RMB can be imposed on the app, while individuals directly responsible may be fined between 10,000 and 100,000 RMB. In severe cases, fines can reach 50 million RMB or 5 % of the previous year’s revenue, and responsible personnel may face fines from 100,000 to 1 million RMB. The term “directly responsible personnel” can include the technical and product staff who actually implement the app.

Benefit: Personal data should be processed only for a clear, legitimate purpose that is directly related to that purpose, using methods that minimize impact on individuals’ rights. Consent from the individual is required unless another legal basis applies. For users under 14, consent from parents or guardians is mandatory. Violations lead to regulatory orders to correct the problem, warnings, and confiscation of illegal earnings; the offending app may be suspended or shut down. Persistent breaches incur fines up to 1 million RMB, while responsible managers and staff may be fined between 10,000 and 100,000 RMB. In extreme cases, fines can exceed 50 million RMB or 5 % of annual revenue, and those individuals may be barred from serving as directors, supervisors, or executives of related companies. Criminal acts involving the sale or disclosure of personal data are covered under Section 4 (National).

Evidence grade: B

Sources:全国人大常委会 (2021). 个人信息保护法（第六、十三、三十一、六十六条）. http://www.npc.gov.cn/npc/c2/c30834/202108/t20210820_313088.html

Notes: In practice, the “directly responsible personnel” label often applies to developers and product managers. The Ministry of Industry and Information Technology regularly publishes lists of removed or penalized apps; however, no specific announcement was identified for this section, so it is not cited here.