What Biometric Data Consent Rules Exist in China for Foreign Firms?

A comprehensive FAQ on PIPL consent requirements for biometric collection, processing, and management — written for foreign enterprises operating in China.

1. What is “separate consent” under PIPL Articles 29–32?

Under the Personal Information Protection Law (PIPL) of the People’s Republic of China, biometric data qualifies as sensitive personal information (SPI). Articles 29 through 32 impose stricter consent requirements for SPI than for ordinary personal information.

The single most important concept is “separate consent” (单独同意). This means:

• The consent for biometric processing must be obtained in a standalone action — it cannot be bundled into a general privacy policy or terms of service.
• The user must be presented with a clear, specific notice describing exactly what biometric data will be collected, for what purpose, how long it will be retained, and whether it will be shared with any third party.
• The consent must be affirmative — pre-ticked boxes, silence, or inaction do not constitute valid separate consent.

Articles 29–32 also require that data processors inform the individual of the necessity of collecting the biometric data and the consequences of refusing. For foreign firms, this is doubly important — Chinese regulators expect notices to be provided in clear, plain Chinese, not legalese, and translated accurately from any English original.

2. Written consent vs. electronic consent — are both valid?

Yes, both written (paper) and electronic consent are valid under PIPL, provided they meet the standard of being freely given, informed, unambiguous, and specific. The PIPL does not mandate a particular medium; it mandates a particular quality of consent.

For foreign firms, electronic consent management is strongly recommended because it provides an auditable trail. Written consent, while legally valid, introduces practical challenges around storage, retrieval, and proof of consent in the event of a regulatory inspection or lawsuit.

3. What counts as biometric data under PIPL?

The PIPL does not exhaustively list every type of biometric data, but the Cybersecurity Administration of China (CAC) and the Standardization Administration have issued guidance (notably GB/T 35273—2020 and the 2023 Regulations on the Security of Personal Information Processing Activities) that define biometric data as any personal information resulting from specific technical processing of the physical, physiological, or behavioral characteristics of a natural person, which can be used for unique identification.

Common examples in a foreign firm’s China operations include:

• Fingerprint scans (time clocks, device login)
• Facial recognition (building access, CCTV surveillance with face tagging)
• Iris scans (high-security areas)
• Palm vein scans (access control)
• Voiceprint (voice-based authentication systems)
• Gait analysis (behavioral biometrics in workplace monitoring)

4. What is the purpose limitation requirement for biometric data?

PIPL Article 6 requires that the collection of personal information be limited to the minimum scope necessary to achieve the processing purpose. For sensitive personal information (biometrics), this principle is even stricter.

Foreign firms must:

• Define a specific, explicit, and legitimate purpose before collecting biometric data (e.g., “employee attendance recording” rather than “workplace management”).
• Ensure the biometric data is not reused for another purpose without obtaining a new separate consent.
• Document the purpose in the consent notice and in the Personal Information Protection Impact Assessment (PIPIA).

A common trap for foreign companies is using a fingerprint time clock for attendance and then, without fresh consent, using the same fingerprint data to unlock office printers or log into workstations. Each new purpose requires a new separate consent.

5. Data retention period disclosure

PIPL Article 19 states that personal information processors must specify the data retention period in the privacy notice. For biometric data, regulators expect the retention period to be the minimum necessary to fulfill the purposeand no longer.

Typical retention benchmarks used by Chinese regulators:

The retention period must be stated in the consent notice. Foreign firms should add a clause specifying that data will be securely deleted or anonymized after the retention period expires. Periodic audits of stored biometric data are strongly recommended.

6. Third-party sharing disclosure requirements

Under PIPL Articles 23 and 30, if a foreign firm transfers biometric data to any third party (including cloud service providers, HR software vendors, or overseas affiliates), the following must be disclosed before collection:

• The identity and contact details of the third party
• The type of biometric data being shared
• The purpose and method of processing by the third party
• The retention period or deletion policy of the third party
• Whether the data will be transferred outside of China

7. Right to withdraw consent (PIPL Articles 15–16)

PIPL Article 15 grants individuals the unconditional right to withdraw consent at any time. Article 16 states that a data processor shall not refuse to provide products or services because the individual withdrew consent — unless the processing of the personal information is necessary for the provision of the product or service.

For foreign firms in the employment context, this creates a nuanced situation:

• An employee can withdraw consent for biometric processing at any time.
• The employer must provide an alternative non-biometric method (e.g., RFID badge, PIN code, manual sign-in) and cannot retaliate or penalize the employee for doing so.
• The withdrawal must be as easy as giving consent — ideally through the same interface or a straightforward HR process.

8. Consequences of consent withdrawal for employment

This is one of the most frequently asked questions by foreign HR and legal teams. The short answer: consent withdrawal for biometric processing cannot be grounds for termination, demotion, salary reduction, or any adverse employment action.

PIPL Article 16, read together with China’s Labor Contract Law, establishes that:

• Biometric data processing is generally not essential for the performance of the employment contract. Attendance can be tracked through alternative means.
• If an employer terminates an employee for refusing biometric collection, the termination would likely be ruled illegal, entailing reinstatement or double severance damages.
• The employer bears the burden of proving that biometrics are strictly necessary for the role — a very high bar that few foreign firms can meet for general office positions.

Foreign firms should update their HR policies to explicitly state that biometric participation is voluntary and that non-participation will not affect employment status, performance reviews, or compensation.

9. Alternative methods for employees who refuse

Employers must offer a reasonable alternative for employees who refuse biometric collection. The alternative should not be punitive or stigmatizing. Acceptable alternatives include:

• Proximity cards / RFID badges for access control and time tracking
• PIN codes or passwords for system login
• Paper sign-in sheets or supervisor attestation for attendance
• QR code scanning via a company mobile app

The alternative method should be reasonably convenient — requiring an employee who refuses fingerprint scanning to walk 15 minutes to a different building to sign in would likely be seen as constructive coercion. Regulators examine the totality of the circumstances to determine whether the alternative is genuine or pretextual.

10. Consent for CCTV / surveillance in the workplace

CCTV in the workplace is common in China, but when it incorporates facial recognition or other biometric identification capabilities, separate consent is required. Key rules:

• Notice requirement: Clear signage must be posted at all CCTV-covered areas stating that biometric-capable surveillance is in use.
• Separate consent: Employees must give separate consent for the biometric processing component of the CCTV system. General CCTV for security (without biometric identification) may be covered under legitimate interest, but the moment facial recognition is enabled, SPI consent rules kick in.
• Restricted zones: Biometric CCTV in restrooms, locker rooms, and private休息室 (rest areas) is strictly prohibited under both PIPL and China’s Personal Information Security Specification (GB/T 35273).

11. Consent for biometric time clocks

Biometric time clocks (fingerprint, facial, or palm scanning for attendance) are among the most common use cases for foreign firms in China. The consent requirements are:

• The clock must display or be accompanied by a notice explaining what biometric data is collected and why.
• A separate consent form (paper or electronic) must be signed before the first scan.
• The consent form must specify whether the biometric template is stored on the device locally, on a local server, or in the cloud.
• If the time clock system is provided by a third-party vendor (e.g., a SaaS attendance platform), the vendor’s role and data access must be disclosed.

Foreign firms should ensure that time clocks support an alternative input method (e.g., PIN or card) for employees who have not given biometric consent. The device should not display a “fingerprint required” prompt that could be misconstrued as mandatory.

12. Consent for building access systems

Building access via biometric authentication (facial recognition gates, fingerprint scanners at entrances) follows the same consent framework but with additional considerations:

• Visitor consent: One-time consent for visitors may be obtained through a kiosk or reception process, but it must still be specific and informed. A sign at the entrance saying “By entering, you consent to facial recognition” is not sufficient.
• Employee consent: Obtained during onboarding (see Q14). Must specify whether biometric data is used for both building access and attendance tracking if the same system serves both purposes.
• Emergency override: PIPL allows biometric processing without consent in emergency situations (life, health, or property protection under Article 13), but this exception is narrow and does not cover routine building access.

For multi-tenant office buildings where a foreign firm leases space, the landlord may operate the building access system. In that case, the foreign firm should ensure its lease agreement addresses biometric data responsibilities and that its employees are separately informed about the landlord’s biometric processing.

13. Consent for computer monitoring / biometric login

Biometric login for company computers (fingerprint readers, Windows Hello facial recognition, or iris scanners) is a growing area of regulatory attention. Requirements include:

• Device-level vs. enterprise-level: If the biometric login is a built-in feature of a personal device (e.g., a company laptop’s fingerprint reader used for Windows login), and the employer does not centrally collect or store the biometric data, the requirement is less stringent. However, if the employer pushes a biometric authentication policy via Group Policy or MDM and centrally stores biometric templates, separate consent is required.
• Monitoring software: If the employer uses keystroke dynamics, mouse movement analysis, or other behavioral biometrics for productivity monitoring, this is SPI and requires separate consent.
• Screen recording: Automatic screen capture with face detection is biometric processing and requires consent.

14. Existing employees vs. new hires

The PIPL transition rules and implementing regulations draw a practical distinction between existing employees and new hires, though the legal requirements are the same:

For retrospective consent campaigns among existing employees, foreign firms should communicate clearly that participation is voluntary and that alternative methods are available. A high-pressure “re-consent or else” approach risks invalidating the consent and creating labor relations issues.

15. Record-keeping requirements for consent documentation

PIPL Article 55 and the accompanying Measures on Personal Information Protection Impact Assessment require data processors to document and retain records of consent for sensitive personal information processing. Specific requirements include:

• Retain the consent record for at least 3 years after the processing ends (many foreign firms adopt a 5-year or 6-year policy to align with Chinese labor arbitration and contract law statutes of limitations).
• The record must show: (a) the exact content of the notice presented to the individual, (b) the date and time of consent, (c) the method of consent, and (d) any subsequent withdrawal or modification.
• For electronic consent: retain server logs showing the user session, the exact version of the consent screen, timestamps, and IP addresses.
• For written consent: retain the original signed form or a high-resolution scanned copy with a verified timestamp.

16. Consent management system best practices

A robust consent management system (CMS) is essential for foreign firms collecting biometric data at scale in China. Recommended features include:

• Granular consent capture: Separate consent options for each biometric use case (attendance, access, login, CCTV).
• Versioned notices: When the privacy notice changes, the system should require re-consent or at minimum notify users of the change.
• Withdrawal mechanism: A self-service portal or HR workflow where employees can withdraw or modify consent at any time, with immediate effect.
• Audit trail: Immutable logs of every consent event, including the notice version presented.
• Language support: All consent interfaces available in Chinese (simplified) with English as a supplementary language. Chinese-language consent is the legally operative version.
• Integration with HRIS: Automated mapping of consent status to biometric device provisioning (e.g., if consent is withdrawn, the employee’s biometric template is deleted from the time clock within 24 hours).

Several international and China-local vendors offer consent management solutions that support PIPL compliance, including OneTrust, Securiti, and local providers like ByteDance’s Feishu compliance module. Foreign firms should evaluate whether a global platform covers PIPL-specific requirements or whether a China-local solution is needed.

17. Template consent language

Below is a model consent clause for biometric data collection by a foreign firm in China. This is for illustrative purposes and should be reviewed by China-qualified legal counsel before use.

The Chinese-language version should be the authoritative version. All disclosures required under Articles 29–30 should be explicitly stated in the same document, not referenced by hyperlink to an external policy.

18. PIPIA requirements before collecting biometric data

PIPL Article 55 mandates that data processors conduct a Personal Information Protection Impact Assessment (PIPIA) before engaging in any of the following activities involving sensitive personal information:

• Processing biometric data (explicitly listed)
• Automated decision-making using personal information
• Entrusting processing to a third party
• Transferring personal information outside of China

The PIPIA must cover at least:

1. The purpose, necessity, and proportionality of the biometric data processing
2. The potential risks to the rights and interests of individuals
3. The security measures in place to protect the biometric data
4. The retention and deletion policy

The PIPIA report must be retained for at least 3 years (Article 56). Foreign firms should note that the PIPIA is not a one-time exercise — it should be reviewed and updated whenever there is a material change in the processing activity, the technology used, or the applicable regulatory guidance.

19. Special rules for minors’ biometric data

Under PIPL Article 31, biometric data of minors under the age of 14 is subject to even stricter protections:

• Consent must be obtained from the parent or guardian, not the minor.
• The notice must be understandable to both the parent and the child.
• Additional measures must be taken to verify the identity of the parent or guardian giving consent.
• Processing of minors’ biometric data is generally discouraged unless strictly necessary for the minor’s safety or legal compliance (e.g., school campus security).

For foreign firms, this is most relevant in contexts such as international schools, summer camps, children’s entertainment venues, or any business that serves minors in China. Collecting biometric data from minors without parental consent can result in fines of up to 5% of annual revenue (PIPL Article 66 — the top-tier penalty level).

20. Enforcement cases (2024–2026) related to consent violations

Chinese regulators have increasingly enforced biometric consent requirements. Notable cases include:

These cases demonstrate a clear escalation in enforcement. Key patterns: (a) fines are increasing year over year, (b) regulators are looking beyond consent forms to actual implementation (e.g., whether real alternatives exist), and (c) personal liability for managers is becoming a real risk.

21. How foreign companies should handle consent differently from domestic firms

While PIPL applies equally to domestic and foreign firms, foreign companies face unique risks and obligations that warrant a differentiated approach:

Summary Checklist for Foreign Firms

• ☐ Identify all biometric data processing activities across all China offices and facilities
• ☐ Obtain separate consent for each biometric use case from every individual
• ☐ Complete and document a PIPIA for each biometric processing activity
• ☐ Implement a consent management system with audit trails and withdrawal capabilities
• ☐ Offer genuine, non-punitive alternative methods for employees who refuse
• ☐ Disclose all third-party sharing and cross-border transfers with separate consent
• ☐ Set and communicate specific retention periods with automated deletion triggers
• ☐ Conduct a retrospective consent campaign for existing employees and legacy data
• ☐ Appoint a China-based DPO and train local HR/IT/legal teams on PIPL consent rules
• ☐ Engage China-qualified legal counsel to review consent forms and privacy notices