China PIPL + Cross-Border Data + Generative AI Measures in 2026

China's privacy regime is the densest in this list. PIPL, the DSL, the CSL, the Generative AI Measures, the Algorithm Recommendation Provisions, and the new January 2026 cross-border certification measures interlock. AI voice and chat for the China market plan a year ahead.

What the law says

The Personal Information Protection Law (PIPL, 2021) governs personal information processing in China and processing of Chinese residents' personal information abroad in connection with services offered or for analysis of behaviour in China. The Data Security Law (DSL, 2021) classifies data and imposes graded protections. The Cybersecurity Law (CSL, 2017) establishes operator and CIIO obligations. The Generative AI Interim Measures (Cyberspace Administration of China, August 2023) require service registration, training-data lawful basis, content moderation, and labelling.

PIPL's three cross-border transfer pathways are now complete: CAC security assessment for high-volume or sensitive transfers; Standard Contractual Clauses on the Chinese model; and personal information protection certification, the third pathway, formalised by the CAC and SAMR Measures published 14 October 2025 and effective 1 January 2026. Volume thresholds and exemptions follow the March 2024 Provisions. CAC enforcement intensified in 2026 with reported penalties up to 5% of global revenue under PIPL Article 66. Algorithm filings remain mandatory for recommendation systems. Foreign LLMs typically deploy through joint-venture or onshore-host arrangements; many global models are not approved for direct consumer deployment in mainland China.

What AI voice/chat must do

A China-facing voice or chat service must localise infrastructure to mainland data centres or use a permitted transfer pathway, file the algorithm with the CAC, register the generative-AI service, label AI-generated content in line with the Generative AI Measures and the deep-synthesis provisions, run real-name verification consistent with platform rules, and apply content moderation against the AIGC content list. Sensitive personal information processing requires separate consent. Children's data triggers stricter consent. Cross-border training data — including data scraped abroad — must respect PIPL's extraterritorial reach if it concerns Chinese residents.

CallSphere posture

Explore a live demo and compare current plans to find the right fit for your business.

flowchart LR
A[CN User] --> B[Onshore Host]
B --> C[CAC Algorithm\nFiling]
B --> D[GenAI Measures\nLabel]
B --> E[Real-Name\nVerify]
B --> F[Content Mod]
B --> G[Cross-Border\nPathway]
G --> H[CAC Cert / SCC]

Compliance checklist

1. Decide the cross-border pathway: CAC assessment, SCC, or certification (effective 1 January 2026).
2. File the algorithm with the CAC for any recommendation or generative AI feature.
3. Register the generative AI service per the 2023 Interim Measures.
4. Localise content moderation to the AIGC list and the deep-synthesis labelling rules.
5. Implement real-name verification at the user-onboarding boundary.
6. Capture separate consent for sensitive personal information.
7. Map data localisation: store and process in mainland China by default.
8. Document training-data provenance and exclude unlawful sources.
9. Apply CIIO obligations if classified — security review, supply-chain audit.
10. Track CAC enforcement bulletins; penalties can reach 5% of global turnover.

FAQ

Can we use a global LLM for Chinese consumers? Almost never directly. Use an approved onshore model or joint-venture deployment.

Is voice biometric data sensitive personal information? Yes — biometric data is sensitive under PIPL Article 28; separate consent required.

What is the certification pathway? A third-party certification confirming that the data exporter and recipient meet PIPL standards; effective 1 January 2026.

Are children's data rules stricter? Yes — under-14 processing requires guardian consent and follows additional Children's Personal Information Protection Provisions.

Do anti-hallucination labels count? The Generative AI Measures require AI-generated content labelling; an anti-hallucination disclaimer alone is not sufficient.

Sources

• Cyberspace Administration of China: https://www.cac.gov.cn/
• PIPL Full Text (NPC Observer translation): https://npcobserver.com/legislation/personal-information-protection-law/
• CAC SCC and Cross-Border Provisions (China Briefing): https://www.china-briefing.com/news/china-cross-border-data-transfer-certification/
• Generative AI Interim Measures (Bird & Bird): https://www.twobirds.com/en/insights/2026/china/china-data-protection-and-cybersecurity-annual-review-of-2025-and-outlook-for-2026
• KWM Cross-Border Personal Information Export Certification: https://www.kwm.com/us/en/insights/latest-thinking/chinas-cross-border-dataregime-key-points-on-personal-information-export-certification.html