What should an app collect as necessary personal information in China? Direct answer

Start with what the user is obtaining, not the app's marketing label. Match that basic function to the 2021 category and map each proposed field to the listed scope. If the app provides several distinct basic functions, document the category and necessary scope for each function rather than treating the broadest category as permission for the whole product.

The list sets the outer scope of information treated as necessary for each stated basic function. It does not require collection of every listed item when the app can deliver the function without it. It also does not make optional analytics, advertising, personalization, contacts, background permissions, or SDK events necessary merely because they support the business.

For every field, device permission, software development kit (SDK), and event, record the product function, collection timing, recipient, purpose, and whether the item is necessary for the basic function. If it is outside the category scope or the function works without it, keep it out of the mandatory flow and do not block the basic function when the user refuses.

Then apply PIPL. Identify the processing basis, give the required notice, keep collection within the minimum necessary range, use the shortest necessary retention, and address sensitive personal information, children under 14, security, individual rights, and personal information protection impact assessment (PIPIA) triggers.