Asia-Pacific · 4 laws · 17 requirements
China: the laws your website or app must follow
If your customers are in China, these are the privacy, consumer, security, accessibility and AI laws SafeLaunch checks your site against, with what each one requires and where in the law it says so.
How a SafeLaunch audit checks each one
- CheckedChecked automatically on every scan
- AI reviewLooked for by the AI analysis, reported only with evidence
- Your answersDecided from your answers to the audit questions
- PreparedPrepared for you in the report's compliance pack
- You confirmA scan can't see this; you need to confirm it
PIPL
In force since 1 Nov 2021; compliance-audit measures from 1 May 2025; cross-border certification measures from 1 Jan 2026.
Who it covers: Processing in China, and abroad when offering products to or analysing people in China.
What it requires of a website or app (8)
- Notice: handler name and contact, purposes, methods, categories, retention, how to exercise rightsCheckedArt. 17
- Consent (separate consent for sensitive data, transfers abroad and public disclosure)CheckedArt. 13–14, 29, 39
- Guardian consent for under-14sYour answersArt. 31
- Security measures and a PIPIA for sensitive data, automated decisions or transfers abroadCheckedArt. 51, 55
- Breach remediation and notificationCheckedArt. 57
- Rights to access, copy, correct, delete and portCheckedArt. 44–47
- Cross-border transfers via security assessment, standard contract or certification (exemptions below thresholds)CheckedArt. 38–39; Provisions 2024
- A designated representative in China for foreign handlers (if if processing from abroad)CheckedArt. 53
Data Security Law
In force since 1 Sept 2021.
Who it covers: Data processing in China.
What it requires of a website or app (2)
- A data security management system and risk monitoringPreparedArt. 27, 29
- Report data security incidents to the authoritiesCheckedArt. 29
Cybersecurity Law
Amended law in force since 1 Jan 2026: fines up to RMB 10M and wider extraterritorial reach.
Who it covers: Network operators in China.
What it requires of a website or app (3)
- Technical security measures against attacks and intrusionsCheckedArt. 21
- Network logs kept for at least 6 monthsPreparedArt. 21(3)
- Real-name registration for services that publish user information (if if users publish content)Your answersArt. 24
Sources:Amended CSL (Greenberg Traurig)
Generative AI Measures & AI Content Labelling Measures
Generative AI Interim Measures since 15 Aug 2023; labelling measures since 1 Sept 2025.
Who it covers: Generative AI services offered to the public in mainland China.
What it requires of a website or app (4)
- AI-generated text, images, audio and video carry explicit labels and implicit (metadata) labels (if if you provide generative AI)AI reviewMeasures for Labelling AI-Generated Synthetic Content
- Users are told the service uses generative AI, and minors are protected from over-reliance (if if you provide generative AI)CheckedInterim Measures (user notice and minors)
- No prohibited content (including obscenity) is generated or shown (if if the product shows adult content)CheckedInterim Measures; Cybersecurity Law Art. 12
- Services with public-opinion attributes complete security assessment and algorithm filing (if if you provide generative AI)AI reviewInterim Measures; algorithm filing rules
Check your site against China's rules
A free scan checks your website or app against these rules in about a minute and shows what applies, with evidence from your pages. The full report gives the exact fix for each finding.
Check my site freeOne free fix in your inbox each week
A new copy-paste prompt for Lovable, Cursor or Claude Code every week, with the rule behind it and how to check it worked, plus the Monday briefing on new laws and deadlines. No spam, unsubscribe in one click.
By signing up you agree to get these weekly emails. We send it with Kit, and you can unsubscribe at any time. What we share with Kit is in our privacy notice.
A plain-language summary of what each law requires of a website or app, from the SafeLaunch rulebook, with the provision and official sources. It is not legal advice and not every duty in each law is listed.