On 6 September 2026, China's Ministry of Public Security announced a "national anti-fraud AI" app. Global Times, citing Xinhua, reports that the Shanghai Public Security Bureau built it under the ministry's guidance. Users describe a suspicious situation in text, audio or video. The app assesses the risk, names the likely scam tactics and gives prevention advice. It also has a Q&A function, video case studies, and digital versions of two official fraud-prevention handbooks. It is on major app stores and runs as WeChat and Alipay mini-programs.
The launch coverage does not say the app is mandatory, and it presents it as a public service. This article does not claim otherwise. The question is what happens to a voluntary state app once local institutions start treating installation as a condition of something else.
The case for the app
Fraud is a real harm, and it falls hardest on older and less digitally fluent people. An AI assistant that a worried person can ask "is this call a scam?" at 11pm is a sensible use of the technology, and it reaches people better than leaflets. It also runs inside WeChat and Alipay, which people already use. A state-built tool that gives free, immediate advice is a better design than a tool that surveils everyone in advance. On the evidence available so far, this one is the advice kind. Nothing in the launch reporting says it demands device permissions or identity registration, though I could not independently check its privacy policy.
The precedent that should worry us
The older National Anti-Fraud Center app is the better guide to how this goes wrong. A China Digital Times compilation of 2021 reporting describes users who said they had to install it to enter a residential compound or to get vaccinated. Others said employers, patrolling police and children's schools pushed it on them. Registration required a name, national ID number and face scan. The same piece cites a Financial Times report that police used the app, then installed on more than 200 million phones, to identify and question people who had viewed overseas financial news sites. Global Times later disputed the surveillance claims. A 2022 Open Technology Fund security assessment found the app requests high-level device permissions, including call logs, installed-app lists and location data. It also repeats the reports of coerced installation, citing apartment complexes, concerts and driving tests.
These are reports and user accounts, not official notices. I could not find a published rule that makes the older app mandatory, which is the point. No formal mandate is needed when a compound manager, an employer or a school can simply ask. The result is compulsion at the edges, with no statute or regulation to challenge, and no court or regulator that has been asked to review it.
What Chinese law already says
China's own statutes supply the test, and it is a reasonable one. The Anti-Telecom and Online Fraud Law, adopted on 2 September 2022 and in force since 1 December 2022, requires anti-fraud work to be done "in accordance with the law" while protecting citizens' legitimate rights (Article 5). Article 4 asks for "precise prevention and control" that preserves people's convenience. Article 18 bars the use of device and location data collected while monitoring abnormal clients for other purposes without client authorization. Article 16 does the same for account-verification information.
The Personal Information Protection Law goes further. Article 6 limits collection to the minimum scope necessary for the stated purpose. Article 34 requires state organs processing personal information for their statutory duties to act within the authority and procedures set by law and administrative regulation. A school or property manager requiring installation is not itself a state organ. But if police patrols or local officials drive the requirement, the app's data practices fall under these tests.
Where proportionality breaks down
Three design questions decide whether a voluntary app stays voluntary in substance.
- Who can ask for proof of installation? If the answer is anyone, the app becomes a pass or credential. Consent given to retain building access or a job is not free consent in any ordinary sense.
- What does the app collect, and what else can it be used for? A tool that only receives what a user types about a suspicious call is low-risk. A tool that reads call logs, installed apps and location can be repurposed. Per the Financial Times account cited above, the older app was reportedly used to flag foreign news visits, which has nothing to do with fraud.
- Who audits it? Article 34 sets a legal limit, but a limit with no published audit, no independent complaint route and no transparency report is not much of a safeguard.
The new AI app inherits none of these answers. They simply have not been given yet, and the launch reporting says nothing about them.
A proportionate standard
A pro-innovation, pro-speech view does not oppose the app. It opposes the drift. Governments should build useful tools, and people should be free to use them. The standard should be simple:
- The ministry should state publicly that neither app is required, and that no employer, school, landlord or venue may condition access on installation.
- Both apps should publish a plain-language data inventory limited to what each function needs, in line with PIPL Article 6.
- Data from fraud reports should be walled off from other policing purposes, extending the logic Article 18 already applies to device data.
- An independent body, not the Ministry of Public Security, should publish periodic audits.
The new app costs little to run and may well help people. The test of whether it stays that way is the older app's record: whether a voluntary tool is kept voluntary in practice, or is allowed to become a condition of everyday life. That outcome is not yet known, and the ministry can still decide it.