No open-access location is known for this record yet.
No open-access location is known for this record yet.
Key Points The Personal Information Protection Law (PIPL) is China’s first dedicated law for personal information protection. It treats children’s personal information (under 14 years old) as sensitive (Article 28) and requires parental consent for processing (Article 31). These two articles underwent five changes during the legislative process, each strengthening children’s protections and increasing the responsibilities of processors. The PIPL’s processing of children’s personal information differs from the European Union’s approach, requiring specific or written parental consent rather than general consent. However, consent might not be the only applicable legal basis (Article 13 PIPL). The PIPL blends an objective age limit (14 years) with a subjective capacity-based approach. In an empirical study, we find that age verification primarily relies on individuals’ self-assertion of age in practice, which provides inadequate children’s protections. The current regulations still leave room for improvement. They currently adopt a ‘one-size-fits-all’ model, deeming all children’s personal information as sensitive and needing equal protection. This creates challenges and the paper suggests tailoring protection measures to different contexts and exploring novel regulatory technologies. The current rules around the legal basis of processing children’s personal information create an overly reliance on a ‘notice-and-choice’ regime; we confirm this through an empirical study. The new Personal Information Protection Law of the P.R. China (PIPL) was officially adopted by the Standing Committee of the Chinese National People’s Congress on 29 August 2021 and went into effect on 1 November 2021. It is the first comprehensive Chinese law that primarily aims to regulate the protection of personal information.1 An important motivation for this law is the protection of children whoever more engage with online services.2 It was estimated that, in 2021, the number of children online users in China stood at 191 million and the Internet penetration rate of minors at 96.8 per cent—an increase of 1.9 percentage points compared with 2020.3 Since safeguarding children’s rights online is a widely recognized priority all over the world,4 China introduced various protection measures for children in the field of personal information protection. In particular, the PIPL deems ‘personal information of children’ as sensitive personal information and recognizes that children need more protection than adults. One key challenge in protecting children’s personal information lies in identifying children and obtaining parental consent.5 Another more general challenge is how personal information processors can achieve reasonable and effective children’s protection as well as ensure that children benefit from participating in online practices.6 Given the novelty of the PIPL and the ever-increasing digitization, the protection of children’s personal information is an important and timely research topic. Previous research studied key issues and questions—both theoretical and practical—concerning the protection of children’s personal information extensively. Thus far, however, research about the situation in China remains rare, particularly in the English literature. Previous Chinese-language studies on this topic fall into three time periods. At first, scholars analysed the theoretical roots of children’s personal information online, such as ensuring ‘the best interests of children’ and protecting children’s fundamental rights.7 These scholars were motivated by the trend of young Chinese citizens spending ever more time online, drew on relevant statistical insights, and called for stronger privacy legislation for children.8 Following up, a rich body of literature points to two dilemmas of child-specific online privacy protection (the individualized versus the average child and the empowerment versus protection), as well as two institutional designs (the unified age standard of children’s consent and the verification of parental consent) and challenges.9 This discussion was an intensely debated topic during the PIPL legislative process (2018–2021). Most recently, scholars studied practical advice considering other countries’ experiences.10 This kind of research followed the enactment of PIPL and tried to put forward effective suggestions based on the problems and challenges in children’s personal information protection in practice. Although the use of privacy policies is common practice among personal information processors and many of them formally follow legal requirements regarding obligatory information, it is doubtful whether they achieve their goal.11 China might learn from the lessons and experiences around children’s privacy protections in other jurisdictions, particularly the General Data Protection Regulation (GDPR)12 in the European Union (EU) and the Children’s Online Privacy Protection Act (COPPA)13 in the USA.14 Both have been on the books for much longer than the PIPL. Conversely, China has a brief, but determined, history of protecting children online, which might give inspiration to law- and policymakers in other jurisdictions. In sum, issues on the protection of children’s personal information have been discussed in but paper that this and topic in China the enactment of the PIPL in 2021. In particular, the of sensitive personal information rules much for research in the Chinese children’s personal information as sensitive personal information the PIPL. research put on challenges in practice. of empirical research creates an important for more research on this topic to the of the PIPL on the of children and the of their rights has been This on three research the protection rules for children’s personal information in have Chinese legal requirements on children’s personal protection been into practice, particularly age verification and the key challenges in practice, and how to the of this paper is as the the legal and around children’s personal information protection in on the legal history and on the changes during the different legislative Since children’s personal information is sensitive personal information the this children’s personal information protection through the of sensitive personal in the we an empirical into privacy protections in Chinese particularly age verification and parental consent. In based on theoretical and practical we key challenges in China and on how to the of the new rules to children’s personal The history of on the protection of children’s online personal information is the China legislation the protection of children’s personal for the protection of children to the Protection which was in However, the rules different and the of Chinese law as a of and on the Protection of Children’s Personal Information Online by the of the was the first for the protection of children’s personal information in China and many rules for practice. It is important to that the PIPL is a fundamental law to personal information and over many other and to of the Chinese the effect of the as the Protection and the be than that of and PIPL is the law in the field of personal information it has priority for the protection of personal information the but rather rules to with personal information that the PIPL One is the to is the legal in of the This an important in parental consent. other and other regulations with the the the of other is to the of PIPL and to rather than which is a standard for personal information that the personal information of 14 years or is sensitive personal information (Article PIPL only minors that 14 years In this the PIPL standard rather than the PIPL comprehensive rules for processing personal information, which can be to children’s personal information two in the PIPL that children’s personal information protection. children’s personal information as sensitive personal consent rules processing children’s personal we into the of the Chinese in the legislative process and the changes they to and during the legislative with the of the were five changes to children’s personal information during the legislative process of the PIPL. The of sensitive personal information not children’s personal information in the first and which was in the PIPL. The of the about children’s personal information protection from 1 to for Personal The of processors to the age of users The of consent from to or other The as a new for information processors that they rules a children’s privacy in five changes the protection of children’s personal information by increasing the responsibilities of information processors. key points regarding children’s personal information the of the with the PIPL. the of children’s personal information protection is and Children’s personal information was not as sensitive information in the first and were different on this is In the first of the it was that processors parental consent they or that their is a This was to processors processing children’s personal information, they parental in the This a to age by Information processors be for not the age of This the the various and and different interests and and during the legislative the important among five points is the of In the first and the for processing children’s information was in Information 14 (the of consent in These that the different rules for processing children’s personal information on parental which is of the various of consent the PIPL. In the however, this was to in for of Personal (the of sensitive personal to this new all the rules to process sensitive personal information be to children’s personal the the of The of children’s personal information is a standard from the of personal rather than a standard on the of this new and that it the protection of children’s personal information is not the PIPL children’s sensitive and personal information more a new for information processors to dedicated rules for children a children’s privacy was to the from This new information processors to be particularly about their and responsibilities in the children’s However, whether it is to a privacy for children remains in this the in the PIPL protection for the of has a process of from to personal information The PIPL the personal information of children as sensitive personal information, which is an important to other The personal information, sensitive personal information, and children’s personal information in China is in children’s information protection rules by on the rules of sensitive personal this we sensitive personal information in China with rules in other jurisdictions, particularly the in the The among personal information, sensitive personal information and children’s personal personal information is a kind of information that to the information Both the PIPL and the protections for this of However, in of legal three key China and the China and the different legal to to personal of personal (Article rather than it only sensitive in the legislative sensitive personal information has been as a legal in the at the protection of personal personal is in the PIPL and is common in different of Chinese or The of personal might be as more objective and to than personal might have different the of the and China use different to personal The of personal sensitive information in the PIPL the of and The PIPL the of sensitive information to be and to with new of personal information and the of and Given the of in practice, Chinese sensitive personal information in and the only of personal in rather than a general The a regarding sensitive personal information and different of personal information in different children’s and but an These two have and more on the approach, the of sensitive in is that of sensitive not be to the in the PIPL might be practical and more the a different legislative compared to the PIPL sensitive personal a in and in processing sensitive personal This on the of that the processing of sensitive personal information the PIPL not the processing of sensitive personal information in it requirements processing this of information specific and protection which can be as and processing for the legal that is in the legal effect of safeguarding and two different to regulate sensitive personal In the current legal only the processing of personal information, children’s personal information, is the processing to be it has to be based on of the legal in 13 of PIPL. The processing of children’s and personal information is consent of the information is or the processing of personal information is in a such as the of a with a legal the of a in the personal information that has been and other as by law or 29 that process sensitive personal information, the consent be or regulations that written consent be for processing sensitive personal information, to be to the Chinese and three of consent. General consent is as the by the of and in a and (Article consent is the of general which to obtaining the consent of the information on a specific In to the requirements of the information the consent of the information for the processing of sensitive personal information, of a consent to of the a written or other that can the which to written consent. on 29 has a about the legal to process sensitive personal information, and how to with the and 13 PIPL. One is that, in the of processing of sensitive personal information or written consent is 13 of the PIPL to sensitive personal information children’s personal in which two processing based and not based on the legal basis is consent or written consent be the consent of a personal information is the only legal in all contexts processing sensitive personal information, which 13 not be to sensitive personal It is important to that the first and of the PIPL in (Article 29 in the that An consent be sensitive personal information is based on the consent. in the the of 29 and on the which longer processing or This is in the legislative that that is a specific and personal information processors can process sensitive personal information, and consent or written The in processing children’s personal information to be that, in a processing processors parental or written rather than general consent. 13 of PIPL about the legal basis to process personal information might still be applicable processing sensitive personal information, which that consent be of legal three to process sensitive personal specific and protection Law the a information is sensitive personal the consent of the in to a but be to in that the three the processing has all three it be still it not fall the legal of a have to personal sensitive information as to a new or In this the processing of the sensitive information the three not of the legal of This is that the PIPL not have a legal the (Article The PIPL protection measures to sensitive personal information, such as a (Article and a personal information (Article more The rules for sensitive personal information in PIPL. The of the legal of minors to consent to processing is a for and an age for the of rights or for the of protections is a the of the child as a of rights be with the of the to The on the of the use of the which it as the age of years the law applicable to the is This was followed by the of the that a over years is an and has for to the legal of to in and rights or by their children online at an and it is estimated that in three users years minors than years to consent to the processing about their personal minors processors to with their personal information, this might their in an and which not the of interests of the The on age years) of in the to all legal in The that a years of is a with for and be by or legal in In a years can which benefit the or with or age and (Article This was an important motivation for the of the consent age standard in the field of Chinese personal information of PIPL 14 years as the age for consent minors over 14 years as information to the and of processing personal information and have the to consent to the processing of their personal information to processing personal information is as an with or age and which the situation of the age than years) is a reasonable to children’s such as the to the to of as well as the to for the the of 14 we legislative in the Chinese the of an from of the about children’s and and how they with as well as the and of a and legal we the age standard as key of Chinese and the and of the law the age of and the age of consent for as well as a in regulations of personal information and unified age standard of children’s consent can be a kind of legal and in the and of This is the of each on a basis can be to and an on personal information processors. This objective with but is not It has been that, from a children’s rights the of the rights not be the for all to the of the of children and their of in their This that different measures be for children and to the Chinese of the PIPL the age of 14 years as a for consent. minors the age of 14 years consent to the processing of their personal the for minors years in the of a that a by a with for be the is with or and (Article This a comprehensive age verification model, an objective (14 years old) with a subjective capacity-based This that of PIPL in years the information the different with different requirements of consent in of kind of consent is for The remains is to the age of users and a general the PIPL requires that personal information processors that have that they have users 14 years parental consent personal that, of the PIPL adopted a different from ‘the personal information or that the is minors 14 years to a personal information the personal information of minors the age of during the legislative not the of processors to the age of an in of which that the of is to personal information The of PIPL that, the processing of personal information personal information rights and interests and in and personal information processors they not at they and other for the it that the verification of users is of the the PIPL not It has been discussed that the age verification an objective with a subjective capacity-based information processors not only have the to the age of the but that they tried their best to the age of the they be at they a of the which can in a of to at the time of or per of the (Article of the PIPL). in the on a subjective capacity-based to the age of it is the of the information to that years to have consent parental in need to that their child is young to a about processing or personal information their child is than 14 of the PIPL consent not only to be by the of parental over the child but for the consent to be by they the PIPL it remains and to the consent. In this three is parental consent the legal for children’s personal is the of parental to parental in the PIPL is of for the processing of children’s personal legal be applicable (Article 13 of the PIPL). in the parental consent is a The of to the and rights to of the personal and other rights and interests (Article of the the personal information protection the about children’s personal information processing is based on the of the best interests and of the child (Article of the the rights to information protection to the rather than the legal This a in practice. be of and children over the and in to online not in a to the best interests of the child parental consent parental and the of children This in China as but it still the legislative process in the first of for Protection of a of the child and a legal However, the and to a from legal the it was to a protecting personal information and the of information and that this the of children to use the It be to a consent or is particularly years or or This was by PIPL in In of the it has been that not into the of the child to be the of the child to their in all them is not into in with the age and of the In the parental consent in PIP
Loading…
Imported from OpenAlex (CC0) — nothing here is generated.