PrivacyChina

China Privacy Law app personal information minimization

How to map app category, basic functions, and necessary personal information under China mobile app personal-information rules.

Minimize each field, permission, SDK event, use, and retention period against a clear purpose. For 39 common app types, the 2021 rules also define the information indispensable to the basic function.

Back to main artifact Review sources

Author

Sorena AI

Published

Jul 5, 2026

Updated

Jul 24, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published Jul 5, 2026

Updated Jul 24, 2026

Overview

An app must collect and use personal information only for a clear, reasonable purpose, keep the processing directly related to that purpose, and use the method with the least effect on individual rights. For 39 common app types, the 2021 provisions add a concrete test: is consumer-side information without which the listed basic function cannot operate. A user who refuses non-necessary information must still be able to use that basic function.

Section 1

1. Define the basic function and each additional purpose

Write the basic function in user terms, such as positioning and navigation, purchasing goods, booking transport, or playing online video. Then separate analytics, advertising, personalization, fraud prevention, support, regulatory checks, and convenience features. A broad label such as service improvement is not enough to show that a field is directly related or indispensable.

Match each basic function to the official 39-category table where a category fits. The table covers installed and preinstalled mobile apps and qualifying mini programs, and its necessary-information definition concerns consumer-side users, not service providers. The category provisions took effect on 1 May 2021; the separate app information-service provisions took effect on 1 August 2022.

For a multi-function app, make a separate category and necessity decision for each basic function.
For an unlisted function, apply PIPL's purpose, direct-relevance, minimum-impact, and shortest-necessary-retention principles instead of borrowing the nearest category.
Record the user type. The category table's definition excludes supply-side personal information, which still requires its own PIPL analysis.
Identify any sensitive personal information early because specific purpose, sufficient necessity, strict protection, additional notice, separate consent, and a pre-processing impact assessment may apply.

Sources for this answer

Necessary Personal Information Scope for Common Types of Mobile Apps

Articles 2-5 define covered apps, consumer-side necessary information, the no-refusal rule, and the basic functions and scopes for 39 categories.

PRC Personal Information Protection Law

Articles 5-7, 13, 17, 19, and 28-30 support purpose limitation, minimum impact, transparency, processing bases, shortest necessary retention, and special handling of sensitive information.

Section 2

2. Test every collection and use

Build the inventory from code and observed behavior, not only from the privacy notice. Include form fields, device permissions, software development kits, identifiers, inferred data, background events, logs, server-side enrichment, recipients, storage, and deletion.

For each item, record the precise purpose, user action, collection point, source, recipient, processing basis, whether it is sensitive, retention period, and deletion event.
For a listed basic function, ask whether the item appears in the official scope and whether the implemented function would fail without it. Listing supports the category boundary; it does not require collection of every listed item.
For permissions that expose more data than needed, reduce precision, frequency, duration, accessible files, or background access and collect only when the relevant feature is used.
Separate required and optional processing in the interface. Do not bundle unrelated purposes into access to the basic function or force agreement to non-necessary processing.
Check each SDK independently. An SDK vendor's default event set or privacy statement does not establish the app provider's necessity or processing basis.

Sources for this answer

Necessary Personal Information Scope for Common Types of Mobile Apps

Articles 3-5 support field-level mapping to an indispensable basic function and the refusal rule.

PRC Personal Information Protection Law

Articles 6, 13-17, and 19 support direct relevance, minimum impact, processing-basis and consent controls, notice, withdrawal, and shortest necessary retention.

Section 3

3. Verify refusal, retention, and release evidence

Test a clean installation and existing account with each optional field, permission, and purpose refused or withdrawn. The binding rule is that the provider may not deny the basic function because the user refuses non-necessary information. Confirm that refusal does not cause a hidden loop, degraded core path, repeated coercive prompt, or collection through another SDK or endpoint. Those test details are Sorena's practical evidence method, not wording prescribed by the regulation.

Retain the app version, category and basic-function decision, data-flow inventory, code or configuration owner, field-level necessity analysis, processing basis, notice and consent version, refusal test, retention rule, deletion test, and approval.
For every retention period, connect the duration to the purpose or a specific legal duty. PIPL's default is the shortest period necessary to achieve the processing purpose unless a law or administrative regulation provides otherwise.
Review release changes to screens, permissions, SDKs, events, purposes, recipients, data categories, user types, regions, and retention. Reopen the assessment before the changed processing begins.
App providers must also maintain data-security controls, monitor risk, remedy security defects or vulnerabilities, and follow the applicable user-notification and authority-reporting rules.

Sources for this answer

Mobile Internet Application Information Service Management Provisions

Articles 10-12 require security remediation, full-process data-security management, compliance with necessary-information scopes, no forced consent, and continued basic service after refusal of non-necessary information.

PRC Personal Information Protection Law

Articles 15-16, 19, 51, and 57 support withdrawal, limits on refusing service, shortest necessary retention, security controls, and incident response.

Operationalize the requirement

Prepare the PIPL and data export evidence file

Sorena AI helps turn the China Privacy Law app personal information minimization decision into owners, controls, and reviewer-ready records.

Research workflow

Map official sources to evidence

Research Copilot connects the official citation, decision, owner, retained evidence, and change history.

Explore next step

Talk to Sorena

Review the China route

Check the China Privacy Law scope decision and unresolved launch questions with Sorena.

Explore next step

Primary sources

References and citations

Mobile Internet Application Information Service Management Provisions

cac.gov.cn

Referenced sections

Articles 10-12 require security remediation, full-process data-security management, compliance with necessary-information scopes, no forced consent, and continued basic service after refusal of non-necessary information.

Necessary Personal Information Scope for Common Types of Mobile Apps

cac.gov.cn

Referenced sections

Articles 3-5 support field-level mapping to an indispensable basic function and the refusal rule.

PRC Personal Information Protection Law

cac.gov.cn

Referenced sections

Articles 15-16, 19, 51, and 57 support withdrawal, limits on refusing service, shortest necessary retention, security controls, and incident response.

Related guides