The Crackdown Graduates from Infrastructure to Individuals
For years, Beijing's approach to WhatsApp was blunt: block the app at the network level and let it go at that. Since 2017, WhatsApp has been inaccessible without a virtual private network (VPN) on China's standard networks. In April 2024, Chinese authorities went a step further, ordering Apple to remove WhatsApp, Signal, Telegram, and Threads from the Chinese App Store. The message was clear — even the ability to install encrypted messaging software should not be available.
In 2026, that message has been codified in law and backed by individual enforcement. The result is a policy environment where accessing WhatsApp is not merely inconvenient but increasingly carries criminal exposure.
The Legal Architecture Hardens
China's Cybersecurity Law, amended by the 14th National People's Congress Standing Committee in October 2025 and effective since January 1, 2026, dramatically increased penalties across the board. Fines for the most serious violations — defined as cases causing "particularly serious consequences" — now reach RMB 10 million (approximately USD 1.4 million) for corporate actors. More relevant to individuals, the amendments also broadened the law's extraterritorial reach: where the old law targeted overseas actors specifically attacking critical infrastructure, the revised statute extends enforcement to any overseas activity that "endangers China's cybersecurity."
On January 31, 2026, China's Ministry of Public Security published a 68-article Draft Law on Cybercrime Prevention and Control, open for public comment until March 2. The draft goes considerably further than its title suggests. Article 39 explicitly lists detecting and severing "illegally established VPNs" among the obligations of hosting and cloud service providers. Police are granted broad decryption authority to "safeguard national security." Real-name verification requirements are extended to cover banking, telecommunications, and internet services simultaneously, with dynamic re-verification triggered by "abnormal operations" — a provision that effectively subjects anyone using circumvention tools to algorithmic re-identification.
Penalties under the draft reach up to RMB 5 million (approximately USD 725,000) in fines, up to 15 days administrative detention for serious violations, and — unusually — travel bans of between six months and three years imposed after punishment has been served. Human Rights Watch, analysing the bill in March 2026, characterised it as embedding the Great Firewall into criminal law rather than simply operational practice.
Enforcement: From Networks to Homes
The legal shift has been accompanied by a visible enforcement escalation. In March 2026, police in Hubei province began raiding private residences and issuing fines for individual VPN use — penalties of 200 to 500 yuan (roughly USD 28–70) were issued to residents who had accessed TikTok and X via circumvention software from their own homes. This marks a deliberate pivot from the prior approach of blocking infrastructure to punishing end-users.
In April 2026, data centres across multiple Chinese provinces received enforcement orders to immediately disconnect servers flagged for unauthorised cross-border traffic, in what observers described as the largest single enforcement operation against circumvention infrastructure in China's history. The pattern is consistent: the legal architecture of 2026 is designed to leave no cost-free pathway to services like WhatsApp.
Steelmanning the Government's Position
Beijing's argument for these measures deserves a fair hearing. Chinese authorities have consistently framed internet controls as essential to preventing foreign-sponsored disinformation, protecting domestic platforms from unregulated foreign surveillance, and curbing genuine cybercrime — cross-border fraud, online scams, and financial crimes that operate through encrypted channels. The January 2026 Cybercrime Prevention Law follows China's accession to the UN Convention Against Cybercrime in October 2025, giving Beijing a multilateral framework within which to present these rules as part of a global effort rather than purely domestic repression. Regulators can point to specific enforcement statistics — the Cyberspace Administration of China shut down 14,624 websites and suspended 127,878 accounts in 2023 alone — as evidence that the legal apparatus does target actual harms, not merely political dissent.
The Case Against — and Why It Is Stronger
The problem is not the stated rationale but the scope of implementation. Encrypted messaging is a foundational tool for journalists, lawyers, researchers, and ordinary people communicating across borders. China's internet freedom score of 9 out of 100 in Freedom House's 2024 assessment — the lowest rating in the world for the tenth consecutive year — reflects a system in which the definition of "cybercrime" has consistently expanded to cover political speech, religious expression, and ethnic minority content.
The arrests of 97 Tibetans in 2025 under the existing Cybersecurity Law, charged for livestreaming and posting videos in Tibetan on domestic platforms like Douyin, illustrate how broad content-based enforcement becomes when legal definitions remain vague. The draft cybercrime law's prohibition of tools enabling "illegal or criminal information" to spread — combined with its real-name verification and decryption provisions — effectively creates a closed-loop surveillance system. WhatsApp's end-to-end encryption is not a national security loophole; it is the technological precondition for private communication.
The extraterritorial dimensions compound the concern. The amended Cybersecurity Law's expanded reach to overseas activities means Chinese citizens abroad — including students, diaspora communities, and researchers — face legal exposure for using encrypted tools that are entirely lawful in the jurisdictions where they reside.
The Global Stakes
China's approach to WhatsApp is not merely a domestic policy choice. With 1.3 billion internet users as of end-2025, China represents the world's largest test case for the proposition that a modernising economy can function with encrypted communication fully excised from public life. Global technology firms with Chinese operations, multinational journalists, and foreign researchers operating in China are all affected by enforcement that is now reaching into individual homes.
The draft cybercrime law has not yet been enacted. But the enforcement trajectory of April 2026 — cracking down at both the infrastructure and individual level simultaneously — suggests the legal framework may be racing to catch up with practice, not the other way around. Proportionate cybercrime regulation has a legitimate place in any legal system. A law that bans the tools of private communication, compels decryption on demand, and punishes users for accessing the global internet is not proportionate — it is the architecture of control mistaken for the architecture of safety.