On 15 September 2026, China's Cyberspace Administration published a batch of ten "typical cases" from recent enforcement in network security, data security and personal information protection. Four of the ten (cases 5 to 8) are personal information cases, and a fifth, a hospital data-leak case, borders on the category. The most instructive is case 8, which involves an unnamed Shanghai technology company. The CAC says it collected personal information beyond what its purpose required and sent it overseas "without having applied for the data export security assessment as required by law". The company was ordered to correct the problem and fined. The CAC cites the Personal Information Protection Law (PIPL) and the Provisions on Promoting and Regulating Cross-Border Data Flows.
The cases come amid a broader campaign. On 2 April 2026 the CAC, the Ministry of Industry and Information Technology and the Ministry of Public Security jointly announced a series of seven special campaigns on personal information protection. They cover apps and SDKs, internet advertising, education, transport, health, finance, and a criminal crackdown on leaking and reselling personal data. The September batch arrives amid that machinery.
The case for the crackdown
The strongest argument for this enforcement is that the harms are real and the rules were not being followed. Case 7 involves a Chongqing real estate company that installed more than ten image-capture devices and stored over 5,000 customers' facial records without their separate consent, partly for marketing arrangements with intermediaries. Case 6 involves a sports app that bundled location, phone and storage permissions into one demand. Case 5 involves a hardware product that sent vehicle and personal data to a WeChat account unencrypted. These are the sorts of practices that privacy laws in the EU, India and the US also aim to stop. Warnings and fines against companies that ignore consent rules are what turn a statute into a norm. The DLA Piper team argued in June that China's regulator has moved past an education phase, and cites a RMB 10 million fine imposed on Ctrip by the Shanghai CAC for illegal overseas transfers.
We accept most of this. Collecting 5,000 faces without consent is not a gray area, and a regulator that publishes concrete cases is doing something useful.
Where proportionality breaks down
Our concern is the data-export case, and it is a concern about process, not about whether privacy matters.
First, the penalty is invisible. In the CAC page we reviewed, none of the ten cases states a fine amount. Case 8 says only that the company was fined, and case 7 says only "warning and fine". A deterrent works only if companies can estimate its size. If penalties are unpublished, a firm cannot tell whether a violation costs a warning or RMB 10 million. Uncertainty of that kind falls hardest on small firms with no China-law counsel. Large multinationals can afford to over-comply.
Second, the case blends two different violations. The Shanghai company was found to have over-collected information (host configuration, usage duration and system data) and to have sent it, together with registration details, to overseas data centres. Over-collection is a clear, defensible violation. Whether sending the data out without an assessment is independently punishable depends on thresholds that firms must interpret themselves. The cited Provisions on Promoting and Regulating Cross-Border Data Flows were written partly to ease the burden, and a model case that does not separate the two issues blurs how much room those relaxations actually leave.
Third, the "typical case" format is a regulatory signal, not a legal ruling. No reasoning is published, no appeal path is described, and the firms are anonymised. Companies cannot cite a typical case as precedent, yet they must treat it as guidance. That is efficient for the regulator, but it is a thin foundation for predictable law.
There is also a cost to openness. Cross-border data flows underpin cloud services, software updates, customer support and research collaboration. When a small Windows application's telemetry becomes a headline enforcement case, the compliance lesson for foreign and domestic start-ups alike may be to localise everything, or to avoid the Chinese market. That outcome is bad for innovation and does not obviously make users safer than a proportionate, risk-tiered approach would.
What a better enforcement model looks like
The China Briefing analysis of the April announcement notes that the 2026 actions directly affect foreign businesses operating in or targeting mainland China. For those companies, and for the Chinese firms alongside them, three improvements would cost the regulator little:
- Publish penalty ranges or the actual amounts, so deterrence is calibrated rather than guessed at.
- Separate over-collection from export violations in model cases, with a short statement of which threshold or exemption was missed.
- Distinguish intent and scale. A firm with 5,000 non-consented face scans is in a different position from one whose app collects excess system telemetry. Graduated outcomes, such as warnings first for first-time, low-risk violations, should be explicit.
The takeaway
The September cases confirm that Beijing is now using PIPL and its data-export rules as live enforcement tools, not just as a compliance framework on paper. Enforcement against facial-recognition misuse and non-consensual collection is defensible and arguably overdue. The weak point is transparency: unstated fines, unexplained thresholds and unreasoned precedents. Rules that companies can read and budget for are better for users and for the digital economy than rules that are enforced loudly but opaquely.