China’s Cyberspace Administration of China (CAC) has published a draft regulation governing how internet applications, SDK operators, app distribution platforms, and smart terminal manufacturers collect and use personal information, opening the text for public comment through February 9, 2026.
The draft introduces a restrictive baseline for biometric data. Applications that collect facial, fingerprint, or voiceprint information must demonstrate a specific purpose and full necessity, apply the least impactful collection method, and adopt strict protection measures. In operational terms, the draft establishes a strong default around data handling: unless otherwise required by law or administrative regulation, or unless a user provides separate consent, biometric data must be stored within the biometric device itself and must not be transmitted externally over the internet.
Retention is also constrained. The draft states that biometric data should not be retained beyond the shortest period necessary to achieve the stated processing purpose, reinforcing a minimization requirement alongside the storage and transmission limits.
Beyond biometrics, the regulation strengthens several compliance obligations that affect identity verification and KYC-style workflows inside apps. It requires clear disclosure of what personal information is collected for each app function, including permissions, frequency of access, and data categories. Separate consent is required for providing personal information to third parties, and apps are generally prohibited from denying services when users refuse consent, unless the information is strictly necessary to deliver the service.
The draft also includes language encouraging the use of China’s national “network identity authentication public service”, which supports registration and identity verification using a network number and network credential. While not mandatory, the reference signals continued policy support for centralized or government-backed identity services as an alternative to app-specific identity collection.
For digital identity and biometrics vendors, the most consequential element is the on-device storage requirement. Absent a specific legal basis or separate user consent, the rule challenges cloud-based biometric architectures that rely on centralized processing for matching, fraud detection, or liveness analysis. The draft may therefore favor device-bound biometric models or platform-mediated approaches, depending on how “biometric device” is interpreted in implementation and enforcement.
The CAC has invited public feedback on the draft, with final requirements expected to follow after the consultation period closes.
Sources: CAC
—
By Ji-seo Kim
