China's PIPL: what it means for cookies and website tracking

What is the PIPL?

The Personal Information Protection Law was adopted by the Standing Committee of the National People's Congress on 20 August 2021 and took effect on 1 November 2021. It is China's first comprehensive personal information law and sits alongside the Cybersecurity Law and the Data Security Law. The Cyberspace Administration of China (CAC) coordinates its enforcement, while other national and local departments supervise it within their own fields (Article 60). Implementing rules, such as the Network Data Security Management Regulations in force since 1 January 2025 and the CAC's rules on cross-border data, fill in the details.

Who does the PIPL apply to?

Article 3 applies the law to the processing of personal information within mainland China, and to processing outside China of the personal information of people in China when the purpose is to offer them products or services or to analyze or assess their behavior. A foreign online shop that sells to customers in China, or a site that profiles visitors in China for advertising, is in scope. Article 53 requires such foreign handlers to set up a dedicated office or appoint a representative in China and report its name and contact details to the authorities. There is no size threshold.

Do cookies need consent in China?

The PIPL defines personal information as information related to an identified or identifiable natural person, recorded electronically or otherwise. A cookie ID that ties a browsing history to a person or a device used by that person falls within that definition. Article 13 lists the legal bases for processing: consent, necessity for a contract with the person, legal duties, public health emergencies, news reporting in the public interest, information already made public, and other cases provided by law. There is no legitimate interest basis, so analytics and advertising cookies that are not necessary for a service the person requested in practice need consent.

The law adds specific rules that touch tracking:

• Sharing with another handler. Before providing personal information to another handler, such as an ad network that uses the data for its own purposes, you must tell the person the recipient's name and contact details, the purpose, the method and the types of data, and obtain separate consent (Article 23). A service provider that only processes data on your behalf under a contract is treated differently (Article 21).
• Automated marketing. When information is pushed or marketing is targeted through automated decision-making, the handler must also offer an option that is not based on the person's characteristics, or a convenient way to refuse (Article 24).
• Sensitive information. Data such as location tracking, financial accounts, health, biometrics and the information of children under 14 requires separate consent and a specific purpose (Article 29).
• No forced consent. A handler may not refuse products or services because a person declines or withdraws consent, unless the processing is necessary to provide them (Article 16).

What must consent look like?

Article 14 requires consent to be given voluntarily and explicitly, by a person who is fully informed. Where the law requires separate consent, it must be asked for on its own, not bundled with general acceptance of a privacy policy. If the purpose, the method or the type of data changes, consent must be obtained again. Article 15 gives people the right to withdraw consent and requires the handler to provide a convenient way to do so. Before processing, the handler must tell people, in clear and easy language, who it is, the purpose and method of processing, the types of data, the retention period and how to exercise their rights (Article 17). For a website, that means a consent dialog with options a visitor actively selects and a privacy notice in Chinese that names the third parties.

How are transfers abroad regulated?

Article 38 allows personal information to leave China only through one of four routes: a security assessment organized by the CAC, a personal information protection certification, a standard contract with the overseas recipient filed under CAC rules, or another condition set by law or the CAC. Article 39 adds separate consent, after telling the person who the overseas recipient is and how to exercise rights against it. The CAC's Provisions on Promoting and Regulating Cross-Border Data Flows of 22 March 2024 relaxed the thresholds: transfers needed for a contract with the person, such as cross-border shopping, delivery or payment, are exempt from the three procedures, as is a handler that is not a critical information infrastructure operator and has sent the non-sensitive personal information of fewer than 100,000 people abroad since 1 January of the year. A security assessment is required from 1 million people, or 10,000 people for sensitive information; in between, a standard contract or certification.

Who enforces the PIPL, and what are the penalties?

Article 66 sets two tiers. For an ordinary violation, the department orders a correction, issues a warning and confiscates illegal gains; if the handler refuses to correct, it can fine up to 1 million yuan, and the responsible managers 10,000 to 100,000 yuan. For a serious violation, a provincial or higher department can fine up to 50 million yuan or 5% of the previous year's turnover, suspend the business or revoke licenses, and fine the responsible managers 100,000 to 1 million yuan and bar them from senior roles for a period. The amended Cybersecurity Law, in force since 1 January 2026, sends infringements of personal information to these PIPL penalties.

What has the CAC done so far?

The largest case is Didi Global. On 21 July 2022 the CAC fined the ride-hailing company 8.026 billion yuan under the Cybersecurity Law, the Data Security Law and the PIPL, and fined its chairman and its president 1 million yuan each. The CAC listed 16 violations, including excessive collection of users' clipboard data and lists of installed apps. Most enforcement against websites and apps takes the form of public notices, orders to correct and app store removals, often for collecting personal information without consent or beyond what the service needs.

What should a website serving China do?

• Map the cookies, tags and SDKs on your site and decide which are necessary; the cookie scanner gives a first list.
• Ask for explicit consent before analytics and advertising cookies run, with a working way to refuse and to withdraw later.
• Ask for separate consent before sharing data with third parties that use it for their own purposes and before sending personal information abroad, and check which transfer route applies.
• If you are outside China and in scope, appoint a representative in China.

China is not in Cookiequiet's default list of regulated countries, but geo-targeting is free on every plan and you can add China to a custom list, so visitors there see the opt-in banner with Reject all and every choice is kept in the consent log. The banner's 24 languages do not yet include Chinese, and every string is editable per language. Compare with Japan, South Korea and the GDPR.