China’s greenlight to allow American ownership of TikTok’s U.S. operations helps address concerns that Chinese ownership of this popular platform for short videos could put millions of U.S. users’ personal information at risk.  This deal should alert Chinese leaders that other Chinese companies operating overseas could face similar challenges unless the country demonstrates its commitment to the protection of personal information.  Two Guiding Cases recently issued by the Supreme People’s Court provide a glimpse of the judicial application of China’s rules on personal information.  More importantly, these two de facto binding cases in China are just the beginning, as revealed by the highest court.

China’s Key Rules on Personal Information

In May 2020, China’s Civil Code was passed to compile, with modifications, the contents originally contained in China’s Adoption Law, Contract Law, General Principles of the Civil Law, General Provisions of the Civil Law, Guarantee Law, Inheritance Law, Marriage Law, Property Rights Law, and Tort Liability Law.  This landmark legislation has 1,260 articles in total.

Articles 1032 to 1039 of the Civil Code are grouped under a chapter titled “Privacy and Personal Information Protection”.  Despite their brevity, these articles serve as a good foundation for the subsequent enactment of China’s Personal Information Protection Law.  For example, there is a clear statement of the fundamental principle that “the personal information of a natural person is protected by law”.  In addition, the term “personal information” is defined as “various information recorded electronically or through other means which, by itself or in combination with other information, can identify a specific natural person”.  The Civil Code provides a few examples of “personal information”, including a natural person’s name, date of birth, identification number, biometric information, address, telephone number, email address, and health information.

“[…] Article 13 […] provides for circumstances under which a ‘personal information processor’ may process the personal information of an individual.”

Slightly more than a year later, in August 2021, China’s Personal Information Protection Law was passed.  Of all 74 articles in this law, Article 13 should be noted because it provides for circumstances under which a “personal information processor” may process the personal information of an individual.  These circumstances include, for example, where the individual’s consent has been obtained or where such processing is “necessary for the conclusion or performance of a contract to which the individual is a party” (“Necessary-for-Contract Circumstance”).  These details represent progress from the Civil Code, but their actual application remained unclear until they were tested in the courts.

Two Guiding Cases

The release of Guiding Case Nos. 265 and 266 in August by the Supreme People’s Court helps shed some light on the application of the Necessary-for-Contract Circumstance.  Each of these two cases concerned a “personal information processor” arguing that it could process the personal information of an individual on the grounds that such processing was necessary for the conclusion or performance of a contract at issue.  The processor in Guiding Case No. 266 successfully convinced the court, but the processor in Guiding Case No. 265 failed and was ordered to compensate the individual whose rights to personal information were infringed.

Guiding Case No. 266 concerned a passenger who chose to use so-called “enjoy first, pay later” services (i.e., services allowing a passenger to enjoy rides first and pay the fares later) when he activated a code to use the public transportation system in a Chinese city.  During the activation, he was required to go through multiple steps via his mobile phone, including clicking some phrases such as “Agree to the Agreements and Activate” linked to service agreements.  These agreements included provisions requiring a passenger to provide personal information such as name, mobile phone number, and identification number.  In addition, in order to use the “enjoy first, pay later” services, the passenger was required by these agreements to authorize a certain credit company to collect additional personal information (e.g., the passenger’s transaction information and fulfillment information) from information providers so as to determine the passenger’s credit history and possibility of not paying the fares.  In a lawsuit brought by the passenger to challenge the collection of such information about him, the court ruled against the passenger, on the grounds that all the information collected was necessary for the performance of the “enjoy first, pay later” service agreements to which the passenger opted to become a party.

Guiding Case No. 265 illustrates how a court ruled against a personal information processor.  In this case, a person sued a technology company for infringing his rights to personal information, claiming, inter alia, that the company collected, through its website and two apps for learning English, his mobile phone number and other information such as his occupation, purposes of learning English, and English fluency, without his consent.  In defense, the company relied on the Necessary-for-Contract Circumstance to explain that the person’s consent was not required, as the information collected was necessary for the company’s performance of its services offered to the user, i.e., it recommended, through its website and apps, appropriate learning content to the user, based on the user’s learning needs ascertained through his information collected via the website and the two apps.

“[…] the court ruled against the technology company because it had collected more information than necessary for the performance of its contract with the plaintiff.”

In the end, the court ruled against the technology company because it had collected more information than necessary for the performance of its contract with the plaintiff.  To reach this decision, the court referred to a regulatory document titled the Provisions on the Scope of Necessary Personal Information for Common Types of Mobile Internet Applications, which was jointly issued in March 2021 by the Cyberspace Administration of China, the Ministry of Industry and Information Technology, the Ministry of Public Security, and the State Administration for Market Regulation.  According to this document, for “learning and education apps whose basic functional services include ‘online tutoring, online classes, etc.’”, the required personal information is “the registered user’s mobile phone number” only.  Since the apps in this case were apps of this type and since the plaintiff did not request additional functional services other than the basic ones (i.e., online tutoring, online classes, etc.), the technology company should only collect the plaintiff’s mobile phone number.

In the announcement where the above two Guiding Cases, together with a few other data-related Guiding Cases, were released, the Supreme People’s Court characterized data as “a fundamental resource, a strategic resource, and an important productive source”.  Given the importance of data in the development of China’s digital economy, the highest court has emphasized that the Chinese judiciary will leverage these Guiding Cases to strengthen the adjudication and enforcement of data-related cases.  This plan is welcome, and one form of improvement needed is the amount of damages awarded to individuals whose rights to personal information are infringed.  For example, in Guiding Case No. 265, the individual was only awarded RMB 2,900 (i.e., approximately USD 400) as damages to cover lawyers’ fees and expenses incurred in collecting evidence.  Increasing the amounts of compensation will give China’s rules on personal information more teeth—a crucial step to show the country’s commitment to the protection of personal information.

---

• The citation of this article is: Dr. Mei Gechlik, TikTok and China’s New Cases on Personal Information, SINOTALKS.COM^®, In Brief No. 60, Oct. 1, 2025, https://sinotalks.com/inbrief/tiktok-personal-information. The original, English version of this article was edited by Nathan Harpainter.  The information and views set out in this article are the responsibility of the author and do not necessarily reflect the work or views of SINOTALKS^®. ↩︎

Related Articles