State Administration for Market Regulation, Measures for the Regulation of Online Trading (Draft for Comments)

Issued: October 20, 2020

Main contents: An online trading operator that collects and uses users' personal information shall secure the authorization and consent of the users whose information is to be collected.  It shall, based on the principles of lawfulness, legitimacy and necessity, expressly state the purpose, necessity, scope and manner of collection and use, and may not use a one-time general authorization, or means such as tacit authorization, authorization bundled with other authorizations or halting of installation and use to compel or compel in a disguised manner users whose information is to be collected to agree to the collection and use of information that is not directly related to its business activities. When collecting and using sensitive information such as biometric information, health information, property information and social interaction information, an online trading operator shall secure the authorization and consent of the users whose information is to be collected on an item by item basis.

An online trading operator and its working personnel shall keep collected personal information strictly confidential and may not provide the same to any third party, including an affiliated party, without the authorization and consent of the users whose information is collected (Article 11).