What are the legal limits on collecting consumer data in China?

For foreign companies conducting market research in China, understanding the legal boundaries of consumer data collection is not optional — it is a compliance prerequisite. China has constructed one of the world’s most comprehensive and stringent data protection regimes over the past five years, built on three foundational laws: the Cybersecurity Law (CSL, 2017), the Data Security Law (DSL, 2021), and the Personal Information Protection Law (PIPL, 2021). Together, these laws create a regulatory framework that is in many respects stricter than Europe’s GDPR.

This guide outlines the key legal limits that foreign companies face when collecting consumer data in China, with practical guidance on how to conduct market research within the boundaries of the law.

1. The Core Legal Framework

Personal Information Protection Law (PIPL)

The PIPL is the most directly relevant law for consumer data collection in market research. Modelled on but diverging significantly from GDPR, PIPL defines “personal information” broadly as any information related to an identified or identifiable natural person — encompassing names, phone numbers, addresses, WeChat IDs, IP addresses, device identifiers, browsing history, purchase records, and any opinion data that can be linked back to an individual.

Key requirements under PIPL for consumer data collection include:

• Consent must be informed, specific, and freely given: Pre-ticked checkboxes do not constitute valid consent. Each purpose of data collection must be separately identified. The “opt-in” standard in China is stricter than the “opt-out” standard still permitted in some US jurisdictions.
• Separate consent for sensitive personal information: Biometric data, financial account information, precise location data, health data, and data about minors under 14 require explicit separate consent — a simple checkbox within a general privacy notice is insufficient.
• Data minimisation principle: Only data that is directly relevant and necessary for the stated research purpose may be collected. This is similar to GDPR’s data minimisation principle but is enforced more strictly in practice by China’s Cyberspace Administration of China (CAC).
• Cross-border transfer restrictions: Personal information collected in China may not be transferred outside China without meeting specific legal requirements. This is one of the most impactful constraints for foreign companies.

Data Security Law (DSL)

The DSL establishes a classification system for data: general data, important data, and core data. “Important data” — defined broadly as data that could harm national security, public interests, or economic stability if compromised — is subject to additional protection requirements. While most consumer market research data falls into the “general data” category, foreign companies should be aware that data collected in certain sensitive sectors (telecommunications, finance, healthcare, transportation, energy) may be classified as important data with stricter handling requirements.

Cybersecurity Law (CSL)

The CSL imposes data localisation requirements for “critical information infrastructure” (CII) operators. While most foreign companies conducting market research are not CII operators themselves, they may interact with CII-operating platforms (e.g., large e-commerce platforms) whose data-sharing policies are shaped by CSL compliance obligations.

2. Specific Legal Limits on Market Research Data Collection

Consent Requirements for Research Participation

Any market research activity that collects personal information from Chinese consumers — whether through surveys, focus groups, interviews, online behavioural tracking, or social media monitoring — requires informed consent. The consent form must, at minimum:

• Identify the data controller (the entity collecting the data)
• Specify the purpose of data collection and processing
• Describe what data will be collected
• State how long the data will be retained
• Inform participants of their rights (access, correction, deletion, withdrawal of consent)
• Provide contact information for the data controller

For online surveys distributed through Wenjuanxing or Tencent Survey, the consent statement must appear before the respondent begins the survey — a simple “by proceeding you consent” is insufficient. The consent screen must offer a genuine option to decline participation.

Restrictions on Profiling and Automated Decision-Making

PIPL Article 24 restricts the use of personal information for “automated decision-making” including user profiling for market analysis purposes. When consumer data collected in one context (e.g., a satisfaction survey) is used to create profiles for a different purpose (e.g., targeted advertising), separate consent is required. This restriction is particularly relevant for foreign companies that use CRM data collected through market research activities to inform marketing campaigns — the two purposes are legally distinct and each requires its own consent basis.

Cross-Border Data Transfer Limits

For most foreign companies conducting market research, the standard contract route is the most practical option. The contract must include specific clauses about data purpose limitation, recipient obligations, sub-processing restrictions, and liability allocation. The CAC’s model contract is mandatory — companies cannot negotiate alternative terms.

This has direct practical implications for how foreign companies handle research data. Raw survey responses, focus group video recordings, and interview transcripts that contain personal information should ideally be stored and processed within China. Only anonymised or aggregated research findings should be transferred outside China for global reporting — and “anonymised” under Chinese law means data that cannot be re-identified through any means reasonably available, not simply data with names removed.

Data Retention Limits

PIPL requires that personal information be retained only for the minimum period necessary to achieve the purpose of collection. For market research, industry practice suggests retaining raw data (with personal identifiers) for 6-12 months after project completion, after which it must be deleted or anonymised. Research agencies in China typically include data retention periods in their client contracts and privacy notices.

Foreign companies should note that Chinese law does not recognise a “legitimate interest” basis for data retention that is as broad as GDPR’s. The 6-12 month retention window is industry custom, not a safe harbour — each company should document its specific retention rationale for each data type.

3. Data Collection Methods: Legal Boundaries by Channel

Online Surveys

Online survey platforms like Wenjuanxing and Tencent Survey have built-in compliance features — consent screens, age verification gates (for categories requiring adult respondents), and data encryption — but the ultimate legal responsibility rests with the company commissioning the research, not the platform. Foreign companies should verify that their survey platform partner has a China-hosted data infrastructure (Wenjuanxing and Tencent Survey both do) and has implemented PIPL-compliant data processing procedures.

Social Media Monitoring

Collecting and analysing publicly available social media data — WeChat Official Account posts, Xiaohongshu reviews, Douyin comments — occupies a legally grey area under PIPL. While the law exempts “purely personal” data processing activities, scraping or systematically collecting public social media data for commercial market research purposes likely falls outside this exemption. The safest approach is to use aggregated, anonymised social listening tools (Newrank, Feigua) that provide trend data without exposing individual user identities, rather than directly scraping user-generated content.

Focus Groups and Interviews

Qualitative research methods require explicit consent from participants, including consent to be audio/video recorded and consent for any cross-border data transfer (e.g., if foreign clients will watch recorded sessions). Recording consent should be obtained separately from participation consent — a participant may agree to take part in a discussion but not consent to being recorded. Focus group facilities in China increasingly include consent management as a standard part of their service.

Retail and Location Data

Collecting consumer behaviour data through in-store Wi-Fi tracking, Bluetooth beacons, or facial recognition analytics is heavily restricted. PIPL treats precise location data and facial image data as sensitive personal information requiring separate explicit consent. A foreign retailer that implemented in-store heatmapping using Wi-Fi probe requests without obtaining opt-in consent from customers could face penalties of up to ¥50 million (approximately €6.5 million) or 5% of annual revenue — the same penalty ceiling as GDPR.

4. Enforcement and Penalties

China’s data protection enforcement has intensified significantly since PIPL took effect. The CAC, together with the Ministry of Industry and Information Technology (MIIT) and the State Administration for Market Regulation (SAMR), has conducted multiple enforcement sweeps targeting apps and companies that collect consumer data without proper consent or beyond declared purposes.

Penalties for non-compliance include:

• Administrative penalties: Fines up to ¥50 million or 5% of the company’s previous year’s revenue for serious violations
• Individual liability: Fines of ¥100,000 to ¥1 million on directly responsible individuals, plus potential career restrictions (prohibition from holding certain corporate positions)
• Suspension of activities: CAC can order suspension of relevant business activities or revocation of business licences for repeated or serious violations
• Civil liability: Individuals whose data rights are violated can sue for damages, and consumer protection organisations can initiate public interest lawsuits
• Criminal liability: In cases of particularly serious violations involving large-scale data breaches or illegal data trading, criminal prosecution is possible

Notable enforcement actions include the 2023 fine of ¥8 billion (€1.04 billion) against Didi Global for data security violations — though this was under the CSL and DSL framework rather than PIPL specifically, it established the precedent that data protection enforcement in China can reach the highest levels of corporate penalty.

5. Practical Compliance Checklist for Foreign Companies

Based on the legal framework described above, foreign companies conducting consumer research in China should implement the following compliance measures:

6. Emerging Developments to Watch

China’s data protection landscape continues to evolve. Several developments on the horizon may affect consumer data collection for market research:

• Stricter enforcement of cross-border transfer rules: The CAC is expected to increase audits of cross-border data transfers, particularly for companies in sectors like automotive, healthcare, and finance that handle large volumes of consumer data.
• AI and data training regulations: New rules being drafted would restrict the use of consumer personal information for training AI models without explicit consent — a development that would affect any research that uses AI-based analysis of consumer data.
• Industry-specific data governance standards: The Cyberspace Administration and MIIT are developing sector-specific data compliance standards, starting with finance, healthcare, and automotive. Foreign companies should monitor whether their industry’s standards impose additional restrictions beyond PIPL.
• National Data Administration: China established a new National Data Administration (国家数据局) in 2023, which is expected to consolidate and streamline data regulations across different agencies — potentially creating clearer rules but also potentially expanding enforcement capacity.

Foreign companies should review their China market research data practices at least annually, as the regulatory environment continues to develop rapidly. Engaging local legal counsel with specific PIPL expertise — rather than relying on general corporate counsel — is a worthwhile investment for any foreign company conducting ongoing consumer research in China.