China’s top internet regulator has signaled a new phase of regulatory rigor in the country’s digital economy, naming and shaming 30 mobile applications and mini-programs for persistent violations of personal information protection laws. The Cyberspace Administration of China (CAC), acting in concert with the Ministry of Industry and Information Technology and the Ministry of Public Security, issued a formal notice targeting a diverse range of services, from education and finance to travel and e-commerce.
The enforcement action, part of a broader 2026 initiative to safeguard digital privacy, highlights four specific categories of non-compliance. Seven apps, including Ruixin Education and Quxueche, were cited for failing to disclose any rules regarding data collection. Another group, led by Lanmao Yunshang and Daxiang Youpin, was reprimanded for demanding excessive permissions that were not necessary for their core functions. This move underscores Beijing's intent to curb the 'wild growth' of data harvesting that has characterized much of China's app ecosystem for over a decade.
Perhaps most significant for international observers is the focus on SDK transparency and the 'right to be forgotten.' Five apps, including the major state-affiliated CTG Travel (Zhonglü Luxing), were found to have inaccurately listed how third-party software development kits (SDKs) process user data. Furthermore, 14 apps—nearly half of the list—failed to provide functional account deletion features, a direct violation of the Personal Information Protection Law (PIPL) which mandates that users have control over their digital footprint.
Operators of the blacklisted applications have been granted a narrow 15-day window to implement rectifications and report back to the CAC. Failure to comply is expected to trigger more severe penalties, including potential removal from app stores or heavy administrative fines. This latest crackdown serves as a stark reminder that Beijing’s regulatory regime is shifting from high-level legislative drafting to granular, technical enforcement, ensuring that the legal framework established by the PIPL and the Data Security Law is strictly upheld in the marketplace.