On 20 September 2026 the Cyberspace Administration of China (CAC) published a notice naming 30 apps and mini-programs for personal information violations. Six published no collection rules. Four demanded unnecessary or repeated permissions. Nine listed their data practices incompletely or inaccurately. Eleven had no effective account-deletion function. Operators must fix the problems within 15 working days of the notice and report back, and the CAC says it will verify the fixes and may impose penalties.
The notice invokes the Cybersecurity Law, the Personal Information Protection Law (PIPL), the Regulations on Network Data Security Management and the Measures for Identifying Illegal Collection and Use of Personal Information by Apps. It is one output of the 2026 personal information protection special campaign run jointly by the CAC, the Ministry of Industry and Information Technology (MIIT) and the Ministry of Public Security (MPS).
The case for this kind of enforcement
The strongest argument for the campaign is that the violations are not close calls. Nobody seriously disputes that an app should tell users what it collects, or that a person who signs up should be able to leave. PIPL Article 6 limits collection to the minimum scope needed for the stated purpose, and Article 47 requires processors to delete personal information in specified circumstances. The Network Data Security Management Regulations, in effect since 1 January 2025, say that processors must promptly handle requests to delete data or cancel accounts and may not set unreasonable conditions (Article 23). Those are baseline consumer protections. A regulator that names apps failing them is enforcing the text of the law, and the 15-working-day cure window gives operators a fair chance to comply.
The campaign also appears to reach scale. The CAC's August progress report says more than 20,000 apps and SDKs were checked, over 1,100 were publicly named, over 400 faced measures such as delisting, and over 4,000 completed rectification. That is far more coverage than case-by-case litigation could deliver.
What the pattern shows
Look at the apps named. The examples visible in the notice are small utilities and niche tools: a fitness app, a land-area measuring tool, a translation app, an ROI calculator. These are the developers who most plausibly omitted a privacy policy or an account-deletion button because they lacked legal advice. They are not the platforms that hold data on hundreds of millions of people.
That is a defensible allocation of effort, because checklist violations are easy to detect and prove. It also means the headline counts measure how many apps a testing process found, not how much harm users suffered. A tally of 1,100 named apps says little about whether personal data is better protected. The statute's maximum penalty is up to RMB 50 million or 5% of prior-year turnover under Article 66, but a fix-within-15-days notice sits at the opposite end of the penalty range. For a small developer, the naming itself and the risk of delisting do most of the work.
The approach also continues earlier patterns. In 2024 the CAC reported interviewing 11,159 website platforms and imposing warnings or fines on 4,046, taking down 200 apps and acting against 40 mini-programs. Public naming has been the regulator's habitual instrument for years. The 2026 campaign's gains are in volume and the clearer grounding in the 2025 regulations.
Where proportionality needs watching
Our concern is not that China enforces data rules, but how. Three points deserve scrutiny.
First, a deadline of 15 working days is workable for an app with a deletion function that is merely broken. It is harsh for a solo developer who must build account deletion, a privacy policy and a permission redesign, and who also faces delisting from app stores if the fix is late.
Second, public naming operates as a penalty before any process establishes the facts. The full lists in the notice are published as images, and the notice describes the violations only by category. A named operator has few formal means to contest a finding before the reputational harm lands.
Third, the same enforcement apparatus has a security mandate. The MPS co-leads the campaign. Data-protection rules that bind private companies tightly while leaving state access outside the same scrutiny protect users against commercial overreach, not against every kind of intrusion. Honest analysis should say so plainly rather than treat the app campaign as a complete privacy regime.
What good practice would look like
For a pro-innovation regulatory model, the useful features of this campaign are worth keeping: concrete, testable standards, a published cure period, and a focus on user-facing basics such as disclosure and deletion. Other jurisdictions that struggle to enforce privacy law against small developers could learn from the clarity of the checklist.
The features to adapt rather than copy are the proportionality safeguards. Notices should state the evidence behind each finding, give small operators a longer cure window or tiered deadlines, and publish outcomes, including how many named apps were cleared on re-inspection. Enforcement metrics should track user outcomes, such as deletion requests honoured, and not only counts of apps named and removed.
The 30-app notice is therefore best read as routine maintenance of a compliance regime. It shows that PIPL's day-to-day force comes from inspection and naming, with the large-penalty provisions held in reserve. Whether that is good news for users depends on whether the pipeline reaches the large data holders as consistently as it reaches the small ones.