TLDR; Below is the English-translated version of China’s Provisions on the Administration of Algorithm Recommendation for Internet Information Services (互联网信息服务算法推荐管理规定, Cyberspace Administration of China Order No. 9), published December 31, 2021 and in effect since March 1, 2022.
If your company operates an app, website, or platform in mainland China that ranks, personalizes, pushes, filters, or otherwise recommends content to users, these Provisions — China’s first dedicated rulebook for recommendation algorithms — set out the obligations you must meet: telling users that algorithms are in use, offering an opt-out and the ability to delete personal-characteristic tags, protecting minors, the elderly, gig workers, and consumers, and filing qualifying algorithms with the national registry. They build on the Cybersecurity Law, the Data Security Law, and the Personal Information Protection Law (PIPL), and together with the Deep Synthesis Provisions and the Generative AI Measures form the core of China’s algorithm-governance regime that every international business should confirm with counsel.
Provisions on the Administration of Algorithm Recommendation for Internet Information Services (Promulgated December 31, 2021 by Order No. 9 of the Cyberspace Administration of China, the Ministry of Industry and Information Technology, the Ministry of Public Security, and the State Administration for Market Regulation; effective March 1, 2022)
Chapter I — General Provisions
Article 1. These Provisions are formulated in accordance with the “Cybersecurity Law of the People’s Republic of China,” the “Data Security Law of the People’s Republic of China,” the “Personal Information Protection Law of the People’s Republic of China,” the “Measures for the Administration of Internet Information Services,” and other laws and administrative regulations, in order to regulate algorithm recommendation activities in internet information services, promote the core socialist values, safeguard national security and the public interest of society, protect the lawful rights and interests of citizens, legal persons, and other organizations, and promote the healthy and orderly development of internet information services.
Article 2. These Provisions apply to the use of algorithm recommendation technology to provide internet information services (hereinafter referred to as “algorithm recommendation services”) within the territory of the People’s Republic of China. Where laws or administrative regulations provide otherwise, those provisions shall prevail.
The “use of algorithm recommendation technology” referred to in the preceding paragraph means the use of algorithm technologies such as those for generation and synthesis, personalized pushing, ranking and selection, retrieval and filtering, and scheduling and decision-making to provide information to users.
Article 3. The national cyberspace administration department is responsible for the overall planning and coordination of the governance of algorithm recommendation services and the related supervision and administration throughout the country. The relevant departments of the State Council for telecommunications, public security, market regulation, and the like are responsible for the supervision and administration of algorithm recommendation services in accordance with their respective duties.
Local cyberspace administration departments are responsible for the overall planning and coordination of the governance of algorithm recommendation services and the related supervision and administration within their respective administrative regions. Local departments for telecommunications, public security, market regulation, and the like are responsible for the supervision and administration of algorithm recommendation services within their respective administrative regions in accordance with their respective duties.
Article 4. The provision of algorithm recommendation services shall comply with laws and regulations, respect social morality and ethics, observe commercial ethics and professional ethics, and follow the principles of fairness and justice, openness and transparency, scientific rationality, and honesty and good faith.
Article 5. Relevant industry organizations are encouraged to strengthen industry self-discipline, establish and improve industry standards, industry guidelines, and self-regulatory management systems, and urge and guide algorithm recommendation service providers to formulate and refine service norms, provide services in accordance with the law, and accept social oversight.
Chapter II — Information Service Norms
Article 6. Algorithm recommendation service providers shall uphold mainstream value orientation, optimize the mechanisms of their algorithm recommendation services, actively disseminate positive energy, and promote the application of algorithms for the good.
Algorithm recommendation service providers may not use algorithm recommendation services to engage in activities prohibited by laws and administrative regulations, such as endangering national security and the public interest of society, disrupting economic order and social order, or infringing upon the lawful rights and interests of others; may not use algorithm recommendation services to disseminate information prohibited by laws and administrative regulations; and shall adopt measures to prevent and resist the dissemination of harmful information.
Article 7. Algorithm recommendation service providers shall implement the principal responsibility for algorithm security; establish and improve management systems and technical measures for the review of algorithm mechanisms and principles, science and technology ethics review, user registration, review of information release, data security and personal information protection, countering telecommunications and online fraud, security assessment and monitoring, and emergency response to security incidents; formulate and make public the rules relating to their algorithm recommendation services; and allocate professional personnel and technical support commensurate with the scale of their algorithm recommendation services.
Article 8. Algorithm recommendation service providers shall regularly review, assess, and verify algorithm mechanisms and principles, models, data, and application results, among other things, and may not set up algorithm models that induce users to become addicted or to engage in excessive consumption, or that otherwise violate laws and regulations or ethics and morality.
Article 9. Algorithm recommendation service providers shall strengthen information security management, establish and improve a feature library for identifying illegal and harmful information, and refine the standards, rules, and procedures for adding entries to the library. Where algorithm-generated or synthesized information that bears no conspicuous label is discovered, a conspicuous label shall be added before transmission may continue.
Where illegal information is discovered, transmission shall be stopped immediately, measures such as deletion shall be taken to deal with it, the spread of the information shall be prevented, the relevant records shall be preserved, and a report shall be made to the cyberspace administration department and the relevant departments. Where harmful information is discovered, it shall be handled in accordance with the relevant provisions on the ecological governance of online information content.
Article 10. Algorithm recommendation service providers shall strengthen the management of user models and user tags, and improve the rules governing the points of interest recorded in user models and the rules for managing user tags; they may not record keywords of illegal or harmful information as a user’s points of interest or use them as user tags, nor push information on that basis.
Article 11. Algorithm recommendation service providers shall strengthen the ecological management of the layouts and pages of their algorithm recommendation services, establish and improve mechanisms for manual intervention and independent user selection, and actively present information consistent with mainstream value orientation in key areas such as the first screen of the homepage, trending searches, featured selections, ranking lists, and pop-up windows.
Article 12. Algorithm recommendation service providers are encouraged to make comprehensive use of strategies such as content deduplication and dispersal intervention, and to improve the transparency and explainability of their rules for retrieval, ranking, selection, pushing, and display, so as to avoid adverse effects on users and to prevent and reduce disputes and controversies.
Article 13. Where an algorithm recommendation service provider provides internet news information services, it shall obtain a permit for internet news information services in accordance with the law, carry out internet news information gathering, editing, and release services, reprinting services, and dissemination platform services in a regulated manner, and may not generate or synthesize false news information, nor disseminate news information released by entities outside the scope prescribed by the State.
Article 14. Algorithm recommendation service providers may not use algorithms to falsely register accounts, illegally trade accounts, manipulate user accounts, or generate false likes, comments, or shares; nor may they use algorithms to block information, over-recommend, manipulate ranking lists or the ordering of search results, or control trending searches or featured selections, or otherwise intervene in the presentation of information, so as to influence online public opinion or evade supervision and administration.
Article 15. Algorithm recommendation service providers may not use algorithms to impose unreasonable restrictions on other internet information service providers, or to obstruct or disrupt the normal operation of internet information services lawfully provided by them, thereby engaging in monopolistic or unfair competition conduct.
Chapter III — Protection of Users’ Rights and Interests
Article 16. Algorithm recommendation service providers shall inform users, in a conspicuous manner, that they provide algorithm recommendation services, and shall publicize, in an appropriate manner, the basic principles, purposes and intentions, and main operating mechanisms of their algorithm recommendation services.
Article 17. Algorithm recommendation service providers shall provide users with an option that is not targeted at their personal characteristics, or provide users with a convenient option to turn off algorithm recommendation services. Where a user chooses to turn off algorithm recommendation services, the algorithm recommendation service provider shall immediately stop providing the relevant services.
Algorithm recommendation service providers shall provide users with the function to select or delete the user tags targeting their personal characteristics that are used for algorithm recommendation services.
Where an algorithm recommendation service provider’s application of algorithms has a major impact on the rights and interests of users, it shall provide an explanation in accordance with the law and bear the corresponding responsibility.
Article 18. Where an algorithm recommendation service provider provides services to minors, it shall fulfill its obligations for the online protection of minors in accordance with the law, and shall facilitate minors’ access to information beneficial to their physical and mental health through means such as developing modes suitable for use by minors and providing services suited to the characteristics of minors.
Algorithm recommendation service providers may not push to minors information that may induce minors to imitate unsafe conduct or conduct contrary to social morality, that may induce bad habits in minors, or that may otherwise affect the physical and mental health of minors; nor may they use algorithm recommendation services to induce minors to become addicted to the internet.
Article 19. Where an algorithm recommendation service provider provides services to the elderly, it shall protect the rights and interests that the elderly enjoy in accordance with the law, give full consideration to the needs of the elderly in matters such as travel, medical treatment, consumption, and the handling of affairs, provide intelligent services adapted to the elderly in accordance with the relevant provisions of the State, carry out the monitoring, identification, and handling of information involving telecommunications and online fraud in accordance with the law, and facilitate the safe use of algorithm recommendation services by the elderly.
Article 20. Where an algorithm recommendation service provider provides work scheduling services to workers, it shall protect the lawful rights and interests of the workers, such as obtaining labor remuneration and rest and leave, and shall establish and improve the relevant algorithms for platform order distribution, remuneration composition and payment, working hours, and rewards and penalties.
Article 21. Where an algorithm recommendation service provider sells goods or provides services to consumers, it shall protect consumers’ right to fair dealing, and may not, on the basis of consumers’ preferences, transaction habits, or other characteristics, use algorithms to impose unreasonable differential treatment with respect to transaction prices or other transaction conditions, or engage in other such unlawful conduct.
Article 22. Algorithm recommendation service providers shall set up convenient and effective entry points for user appeals and for public complaints and reports, specify the handling procedures and the time limits for feedback, and promptly accept, handle, and give feedback on the results of handling.
Chapter IV — Supervision and Administration
Article 23. The cyberspace administration department, together with the relevant departments for telecommunications, public security, market regulation, and the like, shall establish a graded and categorized security management system for algorithms, and shall implement graded and categorized management of algorithm recommendation service providers on the basis of factors such as the public-opinion attributes or social-mobilization capacity of the algorithm recommendation services, the category of their content, the scale of their users, the degree of importance of the data processed by the algorithm recommendation technology, and the degree of intervention in user conduct.
Article 24. An algorithm recommendation service provider with public-opinion attributes or social-mobilization capacity shall, within 10 working days from the date on which it begins to provide services, complete the filing formalities by submitting, through the internet information service algorithm filing system, information such as the service provider’s name, form of service, field of application, type of algorithm, algorithm self-assessment report, and the content it proposes to publicize.
Where there is any change in the filing information of an algorithm recommendation service provider, it shall carry out the formalities for the change within 10 working days from the date of the change.
Where an algorithm recommendation service provider terminates its services, it shall carry out the formalities for deregistration of the filing within 20 working days from the date of termination of services, and shall make proper arrangements.
Article 25. After the cyberspace administration departments of the State and of the provinces, autonomous regions, and municipalities directly under the Central Government receive the filing materials submitted by a filing party, if the materials are complete, they shall grant the filing within 30 working days, issue a filing number, and publicize it; if the materials are incomplete, they shall not grant the filing and shall, within 30 working days, notify the filing party and explain the reasons.
Article 26. An algorithm recommendation service provider that has completed filing shall indicate its filing number in a conspicuous position on the website, application, or the like through which it provides services to the public, and shall provide a link to the publicized information.
Article 27. An algorithm recommendation service provider with public-opinion attributes or social-mobilization capacity shall carry out a security assessment in accordance with the relevant provisions of the State.
Article 28. The cyberspace administration department, together with the relevant departments for telecommunications, public security, market regulation, and the like, shall carry out security assessment and supervision and inspection of algorithm recommendation services in accordance with the law, and shall promptly put forward rectification opinions on problems discovered and order rectification within a time limit.
Algorithm recommendation service providers shall retain network logs in accordance with the law, cooperate with the cyberspace administration department and the relevant departments for telecommunications, public security, market regulation, and the like in carrying out security assessment and supervision and inspection, and provide the necessary technical, data, and other support and assistance.
Article 29. The relevant institutions and personnel participating in the security assessment and supervision and inspection of algorithm recommendation services shall keep confidential, in accordance with the law, the personal privacy, personal information, and commercial secrets they become aware of in the performance of their duties, and may not disclose them or illegally provide them to others.
Article 30. Any organization or individual that discovers conduct in violation of these Provisions may complain or report to the cyberspace administration department and the relevant departments. The department that receives the complaint or report shall handle it promptly and in accordance with the law.
Chapter V — Legal Liability
Article 31. Where an algorithm recommendation service provider violates the provisions of Article 7, Article 8, the first paragraph of Article 9, Article 10, Article 14, Article 16, Article 17, Article 22, Article 24, or Article 26 of these Provisions, if laws or administrative regulations so provide, those provisions shall apply; if laws or administrative regulations do not so provide, the cyberspace administration department and the relevant departments for telecommunications, public security, market regulation, and the like shall, in accordance with their duties, give a warning or a circulated criticism and order correction within a time limit; where the provider refuses to correct or the circumstances are serious, they shall order a suspension of information updates and impose a fine of 10,000 to 100,000 yuan. Where the conduct constitutes a violation of public security administration, a public security administration penalty shall be imposed in accordance with the law; where a crime is constituted, criminal liability shall be pursued in accordance with the law.
Article 32. Where an algorithm recommendation service provider violates the provisions of Article 6, the second paragraph of Article 9, Article 11, Article 13, Article 15, Article 18, Article 19, Article 20, Article 21, Article 27, or the second paragraph of Article 28 of these Provisions, the cyberspace administration department and the relevant departments for telecommunications, public security, market regulation, and the like shall, in accordance with their duties, handle the matter pursuant to the provisions of the relevant laws, administrative regulations, and departmental rules.
Article 33. Where an algorithm recommendation service provider with public-opinion attributes or social-mobilization capacity obtains filing by improper means, such as concealing relevant circumstances or providing false materials, the cyberspace administration departments of the State and of the provinces, autonomous regions, and municipalities directly under the Central Government shall revoke the filing and give a warning or a circulated criticism; where the circumstances are serious, they shall order a suspension of information updates and impose a fine of 10,000 to 100,000 yuan.
Where an algorithm recommendation service provider with public-opinion attributes or social-mobilization capacity terminates its services but fails to carry out the formalities for deregistration of the filing as required by the third paragraph of Article 24 of these Provisions, or where it is subject to an administrative penalty such as an order to close its website, revocation of the relevant business permit, or revocation of its business license as a result of a serious violation of the law, the cyberspace administration departments of the State and of the provinces, autonomous regions, and municipalities directly under the Central Government shall deregister the filing.
Chapter VI — Supplementary Provisions
Article 34. These Provisions shall be interpreted by the Cyberspace Administration of China together with the Ministry of Industry and Information Technology, the Ministry of Public Security, and the State Administration for Market Regulation.
Article 35. These Provisions shall take effect on March 1, 2022.
Closing
The original document was published in Chinese by the Cyberspace Administration of China (together with the Ministry of Industry and Information Technology, the Ministry of Public Security, and the State Administration for Market Regulation); we translated it into English, which is what you read above. This translation is provided for quick comprehension only and should be used at your own discretion and risk — always confirm the current requirements with qualified legal counsel.
If you need further help from our team, contact us today, and our experts will help you keep your presence in China compliant from the ground up.
