A 25-Year-Old Law Gets Rewritten for the Platform Era
On July 3, 2026, the Cyberspace Administration of China (CAC), working with the Ministry of Industry and Information Technology and the Ministry of Public Security, released a revised draft of the Internet Information Service Management Measures for a second round of public comment, open through August 2, 2026. The current version of this law dates to September 25, 2000 — State Council Decree No. 292 — and runs 27 articles, written for an internet China had barely begun to build; the country had roughly 20 million internet users at the time. The revised draft runs 94 articles across six chapters. That is not a tweak. It is a rebuild of the foundational statute governing every website, app, and recommendation system operating in China, translated for an era of billion-user platforms and generative AI.
What Articles 57, 60, and 61 Actually Require
The draft's most consequential provisions target algorithmic systems directly. Article 57 requires security assessments and algorithm filing — plus notification of subsequent changes — for services with AI-driven "opinion-shaping or social mobilization capacity" (CAC, July 3, 2026). Article 60 mandates labeling of AI-generated and synthetic content and bars the malicious removal of those labels. Article 61 goes furthest on recommendation systems specifically: platforms must build "traffic rules and algorithm standards with a positive value-guidance function," regulate how they distribute and boost traffic, and — critically for users — either offer a non-personalized browsing option or a convenient way to refuse personalized recommendations altogether. The same article bars platforms from compelling users to use AI-driven "intelligent information services" in the first place.
The draft also formalizes a size trigger: platforms with more than 50 million registered users or 10 million monthly active users qualify as "large internet platforms" subject to the heaviest obligations — a bar that captures essentially every major Chinese app, from WeChat to Douyin (Geopolitechs, July 2026). Individual liability follows: executives at noncompliant platforms face fines of RMB 100,000 to 1,000,000 and disqualification from serving in security or governance roles.
The Case for the Rule
It is worth stating the strongest version of the case for this draft before dismissing it. Algorithmic recommendation systems genuinely do shape what a billion-plus users see, and the harms critics attribute to them — engagement-optimized addiction loops, opaque discriminatory pricing, and unlabeled synthetic media — are documented, not hypothetical. A mandatory opt-out from personalized recommendation is not a radical idea; the EU's Digital Services Act (Article 27) and Digital Markets Act already require comparable choices from large platforms, and AI-content labeling mirrors emerging norms from the EU AI Act to California's AI transparency law. On these narrow points, Beijing is converging with, not diverging from, global regulatory practice, and a plain reading of Article 61's opt-out and anti-compulsion language would be a real, usable consumer protection if implemented as written.
Where the Draft Overreaches
The problem is what surrounds those provisions. Article 57's filing and security-assessment trigger — "opinion-shaping or social mobilization capacity" — is defined by its political effect, not by a measurable harm like discriminatory output or safety risk. That standard gives regulators discretion to demand a security review of essentially any successful recommendation engine, since virality itself becomes the qualifying condition. Article 61 compounds this by requiring platforms to encode "positive value guidance" into their algorithm design — a content-shaping mandate dressed as a transparency rule. A genuine opt-out right and a state-directed editorial slant on ranking logic are two different instruments; bundling them into one article lets the compliance apparatus built for the former do the political work of the latter.
Enforcement history counsels skepticism that the more protective elements will be applied evenly. Analysis of adjacent CAC internet rules has found that penalties are frequently levied under older, vaguer 1997-era provisions rather than the specific modern rules meant to have superseded them, with wide regional inconsistency in how similar conduct is treated (l3zc.com legal analysis, July 2026). A regime with this much discretionary language and a filing chokepoint at its center is more likely to be enforced selectively against inconvenient platforms than applied uniformly to protect users.
The Verdict
Expanding a 27-article, 2000-era statute to meet a platform-and-AI economy is defensible on its face — the underlying law was genuinely obsolete. The opt-out and anti-compulsion language in Article 61 is a real improvement if it survives contact with enforcement. But a 94-article rulebook that pairs a consumer opt-out with an open-ended security-filing trigger keyed to political salience isn't primarily a privacy or transparency reform. It's a licensing perimeter around any algorithm influential enough to matter — and the platforms most worth protecting users from are exactly the ones with the least room to resist.