China proposes new biometric data rules for app makers

China has proposed a new regulation mandating that apps store biometric data on devices instead of transmitting it through the internet.

The draft law, titled Regulations on Collection and Use of Personal Information of Internet Applications, was released for public feedback last Saturday by the Cyberspace Administration of China (CAC). The regulation introduces stricter rules for apps that collect and use personal information, including clearly disclosing collection rules and obtaining informed consent.

According to Article 15 of the rulebook, apps collecting biometric information must have a specific purpose and sufficient necessity.

“Unless otherwise stipulated by laws and administrative regulations or with the user’s separate consent, internet applications that collect and use facial, fingerprint and voiceprint information must store it in biometric devices and may not transmit it externally through the internet,” according to the proposal.

The retention period of biometric information should not exceed the minimum time necessary for processing, unless otherwise provided by laws and regulations or by obtaining the user’s separate consent.

Apps should also adopt a biometric data collection method that has the least impact on individual rights and interests and implement strict protection measures, the rulebook adds.

The proposal is open for public consultation until February 9th, 2026.

Other articles in the law stipulate that collecting personal information should be strictly limited to what is necessary for providing products or services.

In addition, apps must not collect or use information from individuals other than the user, for example, by accessing the address book, call logs, or SMSs. If personal information is provided to third parties, apps are required to obtain a separate consent from the user, according to the draft.

Article Topics

biometric identifiers  |  biometrics  |  China  |  Cyberspace Administration of China (CAC)  |  data protection  |  data storage  |  mobile app  |  mobile biometrics