China Flags 30 Apps Over Personal Data Practices

China’s Cyberspace Administration (CAC) issued a public notice on September 20, 2026, flagging 30 applications and mini-programs over problems in how they collect and use personal information — the latest output of a year-long enforcement push targeting data-privacy compliance across the country’s mobile ecosystem.

The notice, issued by the CAC’s Secretariat Bureau and published via its “Cyber China” WeChat account, groups the violations into four categories and orders affected operators to complete rectification within 15 working days. The administration said it would verify the fixes with relevant departments and “impose penalties in accordance with the law” based on the results.

Four Categories of Violations

The first group — six apps, including Flow Fit and the recitation app 滑板车背诵 (Skateboard Recitation) — failed to publicly disclose their personal-information collection and use rules.

A second set of four apps, among them iNAP Care and the translation tool 中英翻译通 (Chinese-English Translation), “forcibly or frequently demanded unnecessary permissions,” according to the notice.

A third category of nine apps, including GPS测亩仪 (GPS Land Area Measurer) and ROI计算器 (ROI Calculator), failed to fully and accurately list how they collect and use personal information — for example, by omitting the software development kits (SDKs) embedded in their software.

The largest group — 11 apps — failed to provide an effective account-cancellation function. That list includes 有道乐读 (Youdao Ledu), a reading product operated by NetEase Youdao, one of China’s best-known technology firms. Because the official announcements embed the full rosters as images, the complete tables and company names were reproduced in machine-readable form by the technology outlet IT之家 (ITHome).

Legal Basis and Enforcement

The notice rests on the Cybersecurity Law, the Personal Information Protection Law (PIPL), the Network Data Security Management Regulations, and the Measures for Identifying Illegal and Non-compliant Collection and Use of Personal Information by Apps. As Xinhua reported, the CAC tested apps and mini-programs for their personal-information behavior under a joint initiative launched earlier this year.

That initiative — the “2026 Special Action Series on Personal Information Protection” — was announced on April 2, 2026, by the CAC together with the Ministry of Industry and Information Technology (MIIT) and the Ministry of Public Security (MPS). Coverage of the April launch said the three departments would focus on illegal collection and use of personal information across the internet advertising, education, transportation, health, and finance sectors, and would dynamically adjust priorities as needed.

The September batch reflects that sectoral focus. Several of the flagged items are education-related mini-programs, including 教习网 (a teaching-resources mini-program), 学立升, 常熟教投, 生长圆, and the 静安区学生体检数据查询助手 (a Shanghai student physical-examination data query assistant) — a signal that regulators are scrutinizing school and tutoring platforms that handle minors’ information.

A Recurring Compliance Instrument

The notice is the latest in a series of “naming and shaming” waves rather than a judicial proceeding. China News noted the same four categories and the 15-working-day remediation requirement, confirming the deadline and the reporting channel — a phone line (010-55635865) and the email address appzhili@cac.gov.cn.

China has progressively tightened mobile-app data-privacy regulation since the PIPL took effect in 2021. Previous regular enforcement rounds have named dozens of apps at a time — including batches of 71, 84, 35 ticket-purchasing apps, and 31 apps and SDKs — according to ITHome’s reporting history. Enforcement typically proceeds in stages: public naming, a remediation window, verification, and penalties that can include removal from app stores for non-compliance.

What’s Next

Affected operators have roughly until mid-October 2026 to complete rectification and report back to the CAC. The administration said it would work with relevant departments to verify the fixes and decide on penalties case by case.

For consumers, the practical significance is twofold. The batch highlights concrete, everyday irritants — apps that refuse to delete an account, demand permissions they don’t need, or bury their data rules — and it signals that regulators are willing to name well-known products, not just obscure ones. Whether the 30 operators comply, and how the CAC handles those that don’t, will be the next test of how seriously the framework is enforced.