June 10, 2019

On 28 May, the Cyberspace Administration of China (CAC), the country’s primary data protection authority, launched a comment period on Draft Administrative Measures for Data Security (“the draft measures”). The draft measures are part of China’s effort to expand the country’s data protection framework, and in particular targets the use of personal data within the online advertising ecosystem.

The draft measures propose to introduce the following provisions:

  • Privacy policies must be clear, specific, simple and easy to access and read. Additionally, they must include information regarding the data collected, its place of storage, the security protocols involved, how data subjects can issue complaints and the firm’s data security contact details;
  • A prohibition of forced consent for use of data for bundles of services (‘bundled consent’);
  • A restriction on the use of ‘privacy walls’ which block access to ‘basic’ online services if users don’t provide consent for their personal data to be processed for ‘extended’ purposes e.g. targeted advertising;
  • Targeted content on platforms must be clearly labelled as such and include an option for users to opt out. This includes targeted advertising, as well as targeted content on eCommerce platforms and search engines;
  • Users have a right to demand that entities that hold their personal data delete or correct it upon request;
  • Data controllers share responsibility and liability with their third parties in the securing of personal data;
  • Data controllers must obtain approval from their relevant industry regulator before engaging in cross-border data transfers;
  • Data controllers must file their data collection practices with the CAC in the event that they collect sensitive or important data as part of their operations.

Breach of these provisions could potentially lead to the CAC confiscating the associated income or suspending the business operations or websites concerned.

A number of the provisions overlap with the Information Technology – Personal Information Security Specification, for which amendments were recently issued for comment. This includes proposals to require that parental consent be gathered before collecting data of children under 14, the obligation to appoint a data protection officer and a data breach notification requirement.

Next steps:

  • The draft measures are open for a period of public comment lasting until 28 June 2019, after which the CAC will implement any changes deemed necessary and issue another draft.
  • WFA will continue to monitor privacy developments in China and share further information with members when available.
  • We will continue to update the WFA Global Privacy Map with latest developments. The latest version is always available for Members to download on the WFA Global Knowledge Base.
  • Members can reach out to Catherine Armitage (c.armitage@wfanet.org) or Max Schmidt (m.schmidt@wfanet.org) for more information.


Catherine Armitage
Director of Digital Policy

World Federation of Advertisers
166 Avenue Louise
1050 Brussels, Belgium
+32 2 502 57 40
+32 470 367 677


Global DEI Census 2023

Global DEI Census 2023

💪Starting next week, you can help reshape the #marketing and #advertising industry for good: Wednesday March 15 we launch the Global DEI Census 2023, a 15-minute anonymous questionnaire through which we look at the state of #diversity, #equity and #inclusion in the...