Mobile apps in China
New rules bring stricter regulation and enhanced user protection
18 July 2019
The Provisions for the Administration of the Information Services of Mobile Internet Application, issued by the Cyberspace Administration of China, took effect on 1 August 2016. The key concepts introduced by the Provisions are set out in more detail below. More clarity will, however, be required from the authorities, especially as there is some overlap between the Provisions and other PRC laws which, to a varying extent, may be applicable to mobile apps (including existing guidelines and rules issued by the Ministry of Industry and Information Technology (MIIT), the State Administration of Press, Publication, Radio, Film and Television (SAPPRFT) and the Ministry of Culture).
Definitions and Scope
The provisions apply to both app stores and app providers.
Article 2 of the provisions defines an app as “a piece of application software…that runs on a smart mobile terminal and provides information services to users”. App stores are defined as platforms that provide “via the internet, browsing, search or download services for application software or publication services.”
App providers are defined as the owners or operators of apps that provide information services.
Only app providers who provide “information services” are subject to the provisions. However, the term “information services” itself is not defined (despite appearing in the title). By contrast, app stores will be subject to the provisions whether they provide information services or not.
As such, in a case where the owner and operator of an app are different, it is unclear whether it should be the owner or the operator who has the obligation to comply with the provisions.
Obligations – App Providers
According to Article 7 of the provisions, all app providers must, amongst other obligations:
- verify the basic identification details of their registered users;
- establish a suitable mechanism to protect personal data of the users;
- create a robust content monitoring system to filter out illegal content with features including suspension and restriction of an individual user’s account;
- protect users’ rights to be informed if the app needs to gain access to the user’s details (such as contact lists or location, etc.);
- respect and protect IP rights; and
- record users’ login information and keep it on file for at least sixty days.
In addition to the above, Article 5 of the provisions also sets a qualification threshold, stating that “relevant qualifications specified in laws and regulations” must be demonstrated before an operator can provide mobile app-related services. It remains unclear what exactly these qualifications are. Reference has to be made to other pieces of legislation, some of which imply the need for operators to apply for specific licences. The pieces of legislation are as follows:
Catalogue of Telecommunications Business (MIIT) 2015.12.28 (Telecom Catalogue)
Telecom Catalogue contains a category called “information service business” which is listed as a Type II value-added telecom service (VATS). These services include social media, instant messaging, voice and video calling, anti-virus software and spam filtering services.
Given that VATS providers are required to apply for licences according to Article 4 of the Administrative Measures for the Licensing of Telecommunications Business Operations (MIIT) 2009.3.1, it seems that app providers will need to do the same. Furthermore, licence applications will only be accepted from companies instead of individuals, severely restricting individuals from owning or operating apps.
Provisions on the Administration of Online Publishing Services (SAPPRFT & MIIT) 2016.2.14 (Online Publishing Provisions)
The broad definition included within the Online Publishing Provisions published by SAPPRFT and MIIT comprises all digital works that (i) include features such as editing, producing and processing, and (ii) are offered to the public over information networks. As a consequence, a large proportion of the information provided by app providers would likely qualify as an online publication and require a licence.
Administrative Measures on Internet Information Services of the PRC (State Council) 2000.9.25 (Internet Information Services Measures)
Under the Internet Information Services Measures, internet information services are divided into profitable and non-profitable services. Profitable internet information service providers are required to apply for VATS licences, whereas non-profitable providers are only required to be registered with the relevant local authorities, with no licensing requirement.
Obligations – App Stores
According to Articles 5 and 8 of the provisions, all app stores must:
- register with their local CAC within thirty days of going online;
- verify the identity of app providers on their platforms;
- make sure that app providers protect users’ personal information and respect relevant IP rights; and
- remove non-compliant apps from the store.
Foreign Service Providers
The provisions apply to app providers and app stores operating within the PRC. It is unclear whether foreign service providers operating offshore are allowed to engage in app-related businesses or, if they are allowed to do so, whether they are likely to face any additional obligations or compliance burdens.
Notably, Apple’s app store is technically outside the scope of the provisions as it is an offshore platform. In any event, Apple complies voluntarily with PRC standards and its popularity with consumers has meant the authorities have largely tolerated its presence in the market.
The new app regulations follow swiftly on from the new strict regulations for mobile games that took effect on 1 June 2016. The Circular Regarding the Administration of Mobile Game Publication Services makes it clear that games that are not submitted for approval will be deemed illegal publications and their publishers liable to penalties. In serious cases, the publisher’s licence will be revoked.
As for apps under the new regime, the user experience is likely to be mixed: if the provisions are properly enforced, app users can expect their favourite apps to be of higher quality and at the same time enjoy greater security of their personal information. Conversely, the range of content app users can enjoy may be more limited in the future and the requirement to track and keep records of user behaviour may limit the app user’s freedom of expression.
Despite the increased regulation, the opportunity for businesses remains significant. According to the media research group iiMedia, the first quarter of 2016 saw 444 million active users of third party mobile app stores. China Internet Watch counted 33,000 mobile apps with categories such as photography, health and fitness, travel and navigation, lifestyle, shopping and social/messaging apps all proving popular.