Theory and practice: the protection of children’s personal information in China
Lu Zhang, Konrad Kollnig · International Data Privacy Law · 2023
Key Points The Personal Information Protection Law (PIPL) is China’s first dedicated law for personal information protection. It treats children’s personal information (under 14 years old) as sensitive (Article 28) and requires parental consent for processing (Article 31). These two articles underwent five changes during the legislative process, each strengthening children’s protections and increasing the responsibilities of processors. The PIPL’s processing of children’s personal information differs from the European Union’s approach, requiring specific or written parental consent rather than general consent. However, consent might not be the only applicable legal basis (Article 13 PIPL). The PIPL blends an objective age limit (14 years) with a subjective capacity-based approach. In an empirical study, we find that age verification primarily relies on individuals’ self-assertion of age in practice, which provides inadequate children’s protections. The current regulations still leave room for improvement. They currently adopt a ‘one-size-fits-all’ model, deeming all children’s personal information as sensitive and needing equal protection. This creates challenges and the paper suggests tailoring protection measures to different contexts and exploring novel regulatory technologies. The current rules around the legal basis of processing children’s personal information create an overly reliance on a ‘notice-and-choice’ regime; we confirm this through an empirical study. The new Personal Information Protection Law of the P.R. China (PIPL) was officially adopted by the Standing Committee of the Chinese National People’s Congress on 29 August 2021 and went into effect on 1 November 2021. It is the first comprehensive Chinese law that primarily aims to regulate the protection of personal information.1 An important motivation for this law is the protection of children whoever more engage with online services.2 It was estimated that, in 2021, the number of children online users in China stood at 191 million and the Internet penetration rate of minors at 96.8 per cent—an increase of 1.9 percentage points compared with 2020.3 Since safeguarding children’s rights online is a widely recognized priority all over the world,4 China introduced various protection measures for children in the field of personal information protection. In particular, the PIPL deems ‘personal information of children’ as sensitive personal information and recognizes that children need more protection than adults. One key challenge in protecting children’s personal information lies in identifying children and obtaining parental consent.5 Another more general challenge is how personal information processors can achieve reasonable and effective children’s protection as well as ensure that children benefit from participating in online practices.6 Given the novelty of the PIPL and the ever-increasing digitization, the protection of children’s personal information is an important and timely research topic. Previous research studied key issues and questions—both theoretical and practical—concerning the protection of children’s personal information extensively. Thus far, however, research about the situation in China remains rare, particularly in the English literature. Previous Chinese-language studies on this topic fall into three time periods. At first, scholars analysed the theoretical roots of children’s personal information online, such as ensuring ‘the best interests of children’ and protecting children’s fundamental rights.7 These scholars were motivated by the trend of young Chinese citizens spending ever more time online, drew on relevant statistical insights, and called for stronger privacy legislation for children.8 Following up, a rich body of literature points to two dilemmas of child-specific online privacy protection (the individualized versus the average child and the empowerment versus protection), as well as two institutional designs (the unified age standard of children’s consent and the verification of parental consent) and challenges.9 This discussion was an intensely debated topic during the PIPL legislative process (2018–2021). Most recently, scholars studied practical advice considering other countries’ experiences.10 This kind of research followed the enactment of PIPL and tried to put forward effective suggestions based on the problems and challenges in children’s personal information protection in practice. Although the use of privacy policies is common practice among personal information processors and many of them formally follow legal requirements regarding obligatory information, it is doubtful whether they achieve their goal.11 China might learn from the lessons and experiences around children’s privacy protections in other jurisdictions, particularly the General Data Protection Regulation (GDPR)12 in the European Union (EU) and the Children’s Online Privacy Protection Act (COPPA)13 in the USA.14 Both have been on the books for much longer than the PIPL. Conversely, China has a brief, but determined, history of protecting children online, which might give inspiration to law- and policymakers in other jurisdictions. In sum, issues on the protection of children’s personal information have been discussed in but paper that this and topic in China the enactment of the PIPL in 2021. In particular, the of sensitive personal information rules much for research in the Chinese children’s personal information as sensitive personal information the PIPL. research put on challenges in practice. of empirical research creates an important for more research on this topic to the of the PIPL on the of children and the of their rights has been This on three research the protection rules for children’s personal information in have Chinese legal requirements on children’s personal protection been into practice, particularly age verification and the key challenges in practice, and how to the of this paper is as the the legal and around children’s personal information protection in on the legal history and on the changes during the different legislative Since children’s personal information is sensitive personal information the this children’s personal information protection through the of sensitive personal in the we an empirical into privacy protections in Chinese particularly age verification and parental consent. In based on theoretical and practical we key challenges in China and on how to the of the new rules to children’s personal The history of on the protection of children’s online personal information is the China legislation the protection of children’s personal for the protection of children to the Protection which was in However, the rules different and the of Chinese law as a of and on the Protection of Children’s Personal Information Online by the of the was the first for the protection of children’s personal information in China and many rules for practice. It is important to that the PIPL is a fundamental law to personal information and over many other and to of the Chinese the effect of the as the Protection and the be than that of and PIPL is the law in the field of personal information it has priority for the protection of personal information the but rather rules to with personal information that the PIPL One is the to is the legal in of the This an important in parental consent. other and other regulations with the the the of other is to the of PIPL and to rather than which is a standard for personal information that the personal information of 14 years or is sensitive personal information (Article PIPL only minors that 14 years In this the PIPL standard rather than the PIPL comprehensive rules for processing personal information, which can be to children’s personal information two in the PIPL that children’s personal information protection. children’s personal information as sensitive personal consent rules processing children’s personal we into the of the Chinese in the legislative process and the changes they to and during the legislative with the of the were five changes to children’s personal information during the legislative process of the PIPL. The of sensitive personal information not children’s personal information in the first and which was in the PIPL. The of the about children’s personal information protection from 1 to for Personal The of processors to the age of users The of consent from to or other The as a new for information processors that they rules a children’s privacy in five changes the protection of children’s personal information by increasing the responsibilities of information processors. key points regarding children’s personal information the of the with the PIPL. the of children’s personal information protection is and Children’s personal information was not as sensitive information in the first and were different on this is In the first of the it was that processors parental consent they or that their is a This was to processors processing children’s personal information, they parental in the This a to age by Information processors be for not the age of This the the various and and different interests and and during the legislative the important among five points is the of In the first and the for processing children’s information was in Information 14 (the of consent in These that the different rules for processing children’s personal information on parental which is of the various of consent the PIPL. In the however, this was to in for of Personal (the of sensitive personal to this new all the rules to process sensitive personal information be to children’s personal the the of The of children’s personal information is a standard from the of personal rather than a standard on the of this new and that it the protection of children’s personal information is not the PIPL children’s sensitive and personal information more a new for information processors to dedicated rules for children a children’s privacy was to the from This new information processors to be particularly about their and responsibilities in the children’s However, whether it is to a privacy for children remains in this the in the PIPL protection for the of has a process of from to personal information The PIPL the personal information of children as sensitive personal information, which is an important to other The personal information, sensitive personal information, and children’s personal information in China is in children’s information protection rules by on the rules of sensitive personal this we sensitive personal information in China with rules in other jurisdictions, particularly the in the The among personal information, sensitive personal information and children’s personal personal information is a kind of information that to the information Both the PIPL and the protections for this of However, in of legal three key China and the China and the different legal to to personal of personal (Article rather than it only sensitive in the legislative sensitive personal information has been as a legal in the at the protection of personal personal is in the PIPL and is common in different of Chinese or The of personal might be as more objective and to than personal might have different the of the and China use different to personal The of personal sensitive information in the PIPL the of and The PIPL the of sensitive information to be and to with new of personal information and the of and Given the of in practice, Chinese sensitive personal information in and the only of personal in rather than a general The a regarding sensitive personal information and different of personal information in different children’s and but an These two have and more on the approach, the of sensitive in is that of sensitive not be to the in the PIPL might be practical and more the a different legislative compared to the PIPL sensitive personal a in and in processing sensitive personal This on the of that the processing of sensitive personal information the PIPL not the processing of sensitive personal information in it requirements processing this of information specific and protection which can be as and processing for the legal that is in the legal effect of safeguarding and two different to regulate sensitive personal In the current legal only the processing of personal information, children’s personal information, is the processing to be it has to be based on of the legal in 13 of PIPL. The processing of children’s and personal information is consent of the information is or the processing of personal information is in a such as the of a with a legal the of a in the personal information that has been and other as by law or 29 that process sensitive personal information, the consent be or regulations that written consent be for processing sensitive personal information, to be to the Chinese and three of consent. General consent is as the by the of and in a and (Article consent is the of general which to obtaining the consent of the information on a specific In to the requirements of the information the consent of the information for the processing of sensitive personal information, of a consent to of the a written or other that can the which to written consent. on 29 has a about the legal to process sensitive personal information, and how to with the and 13 PIPL. One is that, in the of processing of sensitive personal information or written consent is 13 of the PIPL to sensitive personal information children’s personal in which two processing based and not based on the legal basis is consent or written consent be the consent of a personal information is the only legal in all contexts processing sensitive personal information, which 13 not be to sensitive personal It is important to that the first and of the PIPL in (Article 29 in the that An consent be sensitive personal information is based on the consent. in the the of 29 and on the which longer processing or This is in the legislative that that is a specific and personal information processors can process sensitive personal information, and consent or written The in processing children’s personal information to be that, in a processing processors parental or written rather than general consent. 13 of PIPL about the legal basis to process personal information might still be applicable processing sensitive personal information, which that consent be of legal three to process sensitive personal specific and protection Law the a information is sensitive personal the consent of the in to a but be to in that the three the processing has all three it be still it not fall the legal of a have to personal sensitive information as to a new or In this the processing of the sensitive information the three not of the legal of This is that the PIPL not have a legal the (Article The PIPL protection measures to sensitive personal information, such as a (Article and a personal information (Article more The rules for sensitive personal information in PIPL. The of the legal of minors to consent to processing is a for and an age for the of rights or for the of protections is a the of the child as a of rights be with the of the to The on the of the use of the which it as the age of years the law applicable to the is This was followed by the of the that a over years is an and has for to the legal of to in and rights or by their children online at an and it is estimated that in three users years minors than years to consent to the processing about their personal minors processors to with their personal information, this might their in an and which not the of interests of the The on age years) of in the to all legal in The that a years of is a with for and be by or legal in In a years can which benefit the or with or age and (Article This was an important motivation for the of the consent age standard in the field of Chinese personal information of PIPL 14 years as the age for consent minors over 14 years as information to the and of processing personal information and have the to consent to the processing of their personal information to processing personal information is as an with or age and which the situation of the age than years) is a reasonable to children’s such as the to the to of as well as the to for the the of 14 we legislative in the Chinese the of an from of the about children’s and and how they with as well as the and of a and legal we the age standard as key of Chinese and the and of the law the age of and the age of consent for as well as a in regulations of personal information and unified age standard of children’s consent can be a kind of legal and in the and of This is the of each on a basis can be to and an on personal information processors. This objective with but is not It has been that, from a children’s rights the of the rights not be the for all to the of the of children and their of in their This that different measures be for children and to the Chinese of the PIPL the age of 14 years as a for consent. minors the age of 14 years consent to the processing of their personal the for minors years in the of a that a by a with for be the is with or and (Article This a comprehensive age verification model, an objective (14 years old) with a subjective capacity-based This that of PIPL in years the information the different with different requirements of consent in of kind of consent is for The remains is to the age of users and a general the PIPL requires that personal information processors that have that they have users 14 years parental consent personal that, of the PIPL adopted a different from ‘the personal information or that the is minors 14 years to a personal information the personal information of minors the age of during the legislative not the of processors to the age of an in of which that the of is to personal information The of PIPL that, the processing of personal information personal information rights and interests and in and personal information processors they not at they and other for the it that the verification of users is of the the PIPL not It has been discussed that the age verification an objective with a subjective capacity-based information processors not only have the to the age of the but that they tried their best to the age of the they be at they a of the which can in a of to at the time of or per of the (Article of the PIPL). in the on a subjective capacity-based to the age of it is the of the information to that years to have consent parental in need to that their child is young to a about processing or personal information their child is than 14 of the PIPL consent not only to be by the of parental over the child but for the consent to be by they the PIPL it remains and to the consent. In this three is parental consent the legal for children’s personal is the of parental to parental in the PIPL is of for the processing of children’s personal legal be applicable (Article 13 of the PIPL). in the parental consent is a The of to the and rights to of the personal and other rights and interests (Article of the the personal information protection the about children’s personal information processing is based on the of the best interests and of the child (Article of the the rights to information protection to the rather than the legal This a in practice. be of and children over the and in to online not in a to the best interests of the child parental consent parental and the of children This in China as but it still the legislative process in the first of for Protection of a of the child and a legal However, the and to a from legal the it was to a protecting personal information and the of information and that this the of children to use the It be to a consent or is particularly years or or This was by PIPL in In of the it has been that not into the of the child to be the of the child to their in all them is not into in with the age and of the In the parental consent in PIPL online and which is to but different to for online to the requirements for consent in of the PIPL. In the of the and the different of and and that a for the PIPL not use the parental or parental in the of that the information processors to ensure is rather than to In other obtaining parental consent is to be and it not to reasonable to parental consent. an information they processing children’s personal information, of the of their or The with this is that this unified parental consent to a for parental consent in practice. parental consent can this which have motivation to children from they have parental consent. empirical research this The of parental consent verification remains and that not only consent in general but parental consent in from in of protection and on children’s and that an of consent in among about children’s personal information protection that parental consent be as a legal basis for of sensitive such as of the have theoretical research and legislative practice in Chinese scholars reliance on consent the parental consent that Chinese law from parental consent to a that privacy by Given the of parental consent in particular, of to children’s through and of the practice through on the of such as which not be with parental have been widely to have a on the of not they still important for to the of the rules in the PIPL. how important of the PIPL in practice. we on two research the age of The we on parental rather than other legal to process children’s personal information, is that consent is by the to information processing in the online In we not on privacy policies has that privacy policies not their An of privacy policies not give into and research that the and their privacy the first research we the and the from the of for an of their age verification The of can be in 1 and to an but users to they to the or The other 13 to all was The common to an in China number is the common only by a number can a an on the other to on the of Information of which into on 1 information to be a to a new than years to a number in However, an can to five at the which a might their child to use their widely use age such as in the of or many to on the is to in in the the to be than 14 a 14 years and not the for a However, a child a of to this children’s privacy that we can only whether a is a child based on the information by the not more age verification in the studied It is that China has a general on in the on the of by Internet Information of In the is a the age of or only use the a time and the The age and on regulations create for children to age information One that it is common that children use information to many children and and use the or minors that use the to the age of users compared with general sensitive personal information information for or an the of a number by to a to a number 1 to not age other than the of a the we on the from the of the Chinese of studied whether they consent and whether they with consent. the by and on consent in Chinese These studied and consent in Chinese and different of consent in Chinese with the each at the first consent was per of as many as different on the can be in The at the first the studied we that per for of consent. This of a or a in with the by and and was not at the with a for consent. the the for the of only a of were from the of which was a to the however, of the PIPL. The not consent of the consent process, for the of and an during the consent to the consent of a confirm the were all by the and children’s personal information processing have the in China that children’s personal information specific protection. The of this was first, we the regulations for processing children’s personal information in and we to Chinese legal requirements on children’s personal protection have been into practice. on the empirical and theoretical of children’s personal information we three suggestions to the problems and challenges in Chinese on children’s personal information protection is currently a ‘one-size-fits-all’ model, which is for the various different online It is to all of children’s personal information as sensitive personal information and equal the of the information and the of it children’s personal information is with the and parental consent as general information or about parental consent) need to be In particular, on different of children’s personal information about parental consent requirements be for different is on the verification of a child is years China has been of the need to children’s and has on the Protection of on the Internet to from the for three to the relevant regulations of we have not the as of the of the PIPL as to the and of a number of that children and their to legal for information and the discussion on children’s personal information protection in the and has been among Chinese Chinese legislation not experiences the of (Article information processors not only have the to the age of the but that or has tried or best to the age of the or be at and However, it is not how much in age verification is from processors how reasonable can be and a it is currently common for processors not to age in practice. empirical that the verification of age currently widely relies on Internet only for their of but not this The process of verification the of personal information of such as and other This challenges for information processors the is in the but specific Chinese to novel and for age among and the Chinese of to create and to children through and the of with such as or an the to child users users their in empirical we not of new to the age among the and during China and other and more age verification the current rules around the legal basis of processing children’s personal information create an overly reliance on a ‘notice-and-choice’ by empirical and the consent is This that the currently of privacy is particularly in the of children’s personal overly reliance on parental consent considering the children and can to issues that children’s privacy and their to be we the new PIPL around parental consent. In on in children’s personal information be protection be to children online or as not by the be from users and their to information processors. Chinese such as and which have and to process children’s personal information, be to use their to and specific protection measures various Chinese exploring new and to the of parental consent. These not on parental but personal information protection measures for such as dedicated for sensitive information, not information from and for Given that in with each a that a of might to a to the and in of privacy protections. the of the China to novel and effective regulatory technologies. in empirical can in the of in at the of such regulatory in practice by This is the that, in or the a of in China that the of such The of such not be to the current of in to with the of the only be to with the of such a first for and to in important be how consent is in practice. legislation in China that such consent be and the use of as the and from that the of specific consent is in a of such regulatory the of sensitive of Most current research for such However, in many have been various that the of their that, a and to has not been over This is that that they have as to need to for and have in over at Data Privacy Law This research is by The National of on the of Internet and The National of of for