Stay informed with free updates
Simply sign up to the Chinese politics & policy myFT Digest — delivered directly to your inbox.
China’s powerful data watchdog has proposed tighter controls over users’ online information, including a nationwide rollout of digital IDs, in a move that met sharp pushback from leading technology experts.
The Cyberspace Administration of China, alongside the country’s Ministry of Public Security (MPS), released draft regulations to issue unified digital IDs for internet users on Friday last week. Concern about the idea has increased over the past few days.
The IDs, which would be jointly administered by the CAC and police, are initially envisaged as voluntary and would be used in place of real names and phone numbers to register on internet platforms.
But the proposal could drastically extend authorities’ oversight over online behaviour, potentially covering everything from internet shopping history to travel itineraries.
Tom Nunlist, associate director at China-focused consultancy Trivium, said the proposals could “significantly expand the government’s ability to monitor people’s activity online. It would give the police much greater insight into what people are doing online.”
Under existing rules, internet users in China must use their personal ID or phone number to register on platforms such as WeChat and microblogging site Weibo. This allows platforms and authorities to police online activity, such as combating cyberbullying and misinformation, as well as to censor critical discussion of the government.
Nunlist said relying on personal IDs had empowered platform companies to gather user data that could be used for their financial gain. Replacing personal IDs with anonymous digital ones would allow the state to monitor online activity while limiting companies’ ability to track consumer behaviour.
In recent years, Beijing has cracked down on what it has called abusive practices by internet companies to collect consumer data, issuing fines and introducing new laws governing data regulation.
But some legal scholars questioned the regulators’ motivations in weakening platforms’ access to user data. Lao Dongyan, a criminal law professor at Tsinghua University, wrote on Weibo that the “claim of protecting personal information is a facade” and that the “real intention” of the draft regulations was to “regulate people’s online behaviour”.
She said the proposed system would be akin to “installing a monitor for everyone’s online behaviour, with all online traces such as one’s internet search history easily collected”.
Some experts also questioned whether the government was better placed than companies to manage sensitive data. Yu Jianrong, a retired professor at the Chinese Academy of Social Sciences, wrote on Weibo that the draft rules raised “social risks”, including the threat of criminals accessing a unified database of individual users’ internet behaviour.
Chinese internet users’ faith in the government to safely store data was severely tested in 2022 after hackers seized a huge trove of personal information from the Shanghai police, which cyber security experts at the time found had been left online and unsecured for months.
Yu also questioned the legal basis for the change, citing a “lack of authority” for the application of online IDs. Lao also said the proposed rules “lack a legal basis from higher laws”.
The CAC did not respond to a request for comment. The MPS could not be reached for comment.
But James Gong, a partner and data protection expert at law firm Bird & Bird, argued that the proposed rules offered users “an alternative to providing their more sensitive personal information” to internet companies and “reduces the possibility of their sensitive personal information being divulged or misused”.
He added: “This is a voluntary regime for the individuals at least at this point.”
The MPS has published a pilot application on Chinese app stores to test the digital ID scheme. According to the app, social media platform Xiaohongshu and Alibaba-owned ecommerce giant Taobao have signed up to test the new verification scheme.
Shen Kui, a law professor at Peking University, wrote in an article posted on a university WeChat account that a unified digital ID that captured all online activity would make users hesitant to post online and limit the “vibrancy of the digital economy”.
Nunlist said the strong response to the proposed change underscored the importance of data protection. “There is a mistaken view that Chinese people care less about their privacy and state intrusion than other places. The apprehension over this rule change is a pretty powerful demonstration that this isn’t the case.”
Additional reporting by Tina Hu in Beijing