Does China's privacy law apply to your website?

Most answers online say either “PIPL applies to everyone” or “only if you’re in China.” The text sits between those two, and the gap matters if you’re about to add Chinese pages and a contact form.

Here’s what the law says, what remains unsettled, and which questions to bring to a local adviser. It’s part of our guide to the legal basics of a website in China.

Does PIPL apply if you have no office or server in China?

Yes, it can. Your location isn’t the test. Article 3 applies PIPL to processing outside China of the information of people in China in these cases:¹

• The purpose is to provide products or services to people in China.
• The processing analyzes or assesses the behavior of people in China.
• Other cases set by law or administrative regulation.

Hosting doesn’t appear in that list. Chinafy states that a site hosted outside China is covered if it collects leads from Chinese users.²⁰

There’s also a court example. In a case published in 2024, the Guangzhou Internet Court ruled against a French hotel group over a guest’s booking data.³⁶

Hunton describes the defendant as France-registered, with its website hosted outside China, and subject to PIPL because it collected information from people in China.³

What counts as providing services to people in China?

Nobody official has drawn the line in anything we could find. Sidley wrote in May 2023, before the Guangzhou decision came out, that the full reach of this jurisdiction “remains untested.”¹¹

Mayer Brown wrote in 2021 of a textual difference from the GDPR: PIPL speaks of “providing” rather than “offering,” so it may catch a site that isn’t aimed at China.⁸

Prighter, which sells representative services, says Chinese authorities have published no guidance, so it borrows signals from EU guidance on the GDPR.¹⁰ Here’s where published views stand:

Your site	Published view	Status
No Chinese version, an occasional order from China	A global e-commerce site “may be caught” because one customer is in China, per Mayer Brown 8	Open: a 2021 reading, and we found no official text on this case
Chinese language, RMB payment, or delivery to China	Signals of offering services, per Prighter 10	Borrowed from EU guidance, not a Chinese test
Behavioral ads or cookie tracking of people in China	An “analysis” signal, per Prighter 10	Morrison Foerster calls behavioral analytics a separate basis for reach 7
Chinese pages with only an enquiry form, no sale online	Not addressed in anything we read	Open: ask a local adviser

The last row is the likely setup for many foreign service firms, and it’s the least documented.

A Chinese page written to win Chinese clients looks close to the purpose described in Article 3. That’s our reading, not a ruling. Planning as if you’re covered is the cautious choice.

1. 1Do your pages seek clients located in China?
2. 2Do you collect personal information from them, or track their behavior?
3. 3Is the collection tied to serving them?
4. 4Three yesesPlan as if PIPL applies.
5. 5Doubt on any oneAsk a local adviser.

Does a small company get a lighter regime?

Don’t assume so. PIPL itself has no size floor, as Morrison Foerster noted in 2021.⁷ New rules for small handlers do exist, but they may not be written for you.

China published simplified measures for handlers of fewer than 100,000 people, in force since September 1, 2026.⁹²²

Article 2 applies them to small handlers “within the People’s Republic of China” (our translation).⁹

Nothing in the text, the CAC’s Q&A, or the CMS and China Briefing notes says a foreign company with no China presence can use these rules.^9232425 We didn’t read the two annexed forms.

They do matter if you run a small Chinese subsidiary. The Provisions set out these simplifications:⁹

Topic	Simplified measure
Privacy notice (Art. 4, 6)	Shorter minimum content. Publishing the rules can be enough if the data is necessary and isn’t shared
Consent (Art. 7)	You may process what people freely provide, fully informed, to get your service, under the published rules
Cross-border (Art. 10)	No assessment, standard contract or certification in listed cases, such as a genuine contract need
Audits (Art. 13)	At least every five years, using an annexed self-check kept for five years
Minor violations (Art. 18)	No penalty if promptly corrected without harm

Sensitive data still needs separate consent, and under-14s need their own rules.⁹ Article 10 keeps notice and separate consent duties for data sent abroad.⁹

What does a website in scope have to do?

It has to tell people what it does, have a legal basis, and respect their rights. These are the rules that touch a typical marketing site:

Duty	Source	On your site
Notice before collecting	PIPL Art. 17 1	Who you are, contact, purpose, method, data types, retention, how to use rights
Legal basis	Art. 13 1	Consent, or necessity for a contract with that person, among others
Valid consent	Art. 14 to 16 1	Informed and explicit, easy to withdraw, new consent if the purpose changes, no refusing service over data you don’t need
Only what’s needed	Regulations Art. 22 2	No extra form fields beyond the service
Sharing with another company	Art. 23 1	Name the recipient, get separate consent
Sensitive data	Art. 28 to 31 1	Separate consent, and parental consent under age 14
People’s requests	Art. 45, 47, 50 1	A working way to access, copy and delete

One difference catches GDPR users. Article 13 has no legitimate interest basis, so a habit built on it doesn’t carry over.¹

What this means for your lead form

Your contact form is usually the main point of collection. Here’s a cautious setup to review with your adviser.

1. Cut the fields. Keep what you need to answer the enquiry.
2. Put the notice by the form. Link to the rules before the send button.
3. Separate marketing. Offer newsletters and follow-ups as an optional, unticked choice.
4. Handle partners separately. If a distributor will receive the lead, name it and ask for separate consent.
5. Keep a record. Fault is presumed in damage claims under Article 69, so you’d want proof.¹
6. Plan for deletion. Say how long you keep a lead, and how to ask for its removal.

Answering a quote request may fit Article 13’s contract basis. Marketing doesn’t follow from that: the Guangzhou court said marketing without consent isn’t necessary to perform a contract.⁴

Form tools and CRMs need checking too. A vendor working for you falls under entrusted processing, which calls for an agreement and oversight.¹

Our guide to forms and reCAPTCHA in China covers the technical side.

Do you need a cookie banner for Chinese visitors?

We found no rule that says so expressly, and sources disagree. FlexyConsent itself notes that PIPL doesn’t mention cookies specifically.¹⁴

Source	Position
Morrison Foerster, August 2023	Banners not common, and not expressly required by PIPL “at least not yet” 12
FlexyConsent, June 2026 (sells consent tools)	Sites should show geo-targeted consent to visitors in China 14
CookieChimp, undated (sells consent tools)	Opt-in required, non-essential cookies off by default 13

The vendor claims have a commercial interest and cite little or nothing beyond the law. Still, tracking people in China can touch the “analyze behavior” limb of Article 3.¹

Does your privacy policy have to be in Chinese?

The law doesn’t say so, but we’d write it in Chinese. Article 17 requires clear, understandable language and names no specific one.¹

Vendors such as FlexyConsent recommend Simplified Chinese notices.¹⁴

A reader of your Chinese page who gets an English-only notice hasn’t obviously been informed. Translation also forces you to state exactly what you do.

The Regulations add that processing rules should be gathered together and easy to find.²

Free check

Is your website visible on Baidu?

Enter your website. We check Baidu, access from China and how your site is set up, then email you the report.

Your websiteCheck my site

Do you need a representative in China?

If Article 3’s second paragraph covers you, the text says yes. Article 53 requires a foreign handler to set up an office or name a representative in China, and to report their contact details.¹

The 2024 Regulations specify the recipient: the city-level cyberspace office where the office or representative is located.²

K&L Gates reads the duty as applying regardless of data volume, and said in January 2022 that there was “no clear guidance” on how to appoint one.¹⁵

We searched and found no published procedure since then. We also couldn’t verify what happens if you don’t have one.

This is the first question to put to a local adviser.

Is sending a lead to your head office a cross-border transfer?

It depends on who collected it. The clearest case is a company in China passing data abroad. The murkier one is your foreign site collecting directly.

Flow	Reading
Chinese subsidiary or agent sends leads to your head office	A transfer: conditions of Art. 38, plus notice and separate consent under Art. 39 1, though the CAC’s Q&A drops consent, not notice, where another Art. 13 basis applies 18
Visitor in China submits a form to your foreign site	Disputed: see below
You pass that lead on to overseas partners for marketing	The conduct at issue in the Guangzhou case 4

On direct collection, Withers wrote in 2023 that the question is controversial. It favors the view that this isn’t an outbound transfer, and reports the opposing view.¹⁶ CMS noted that practitioner view in 2022, and also a certification draft that seemed to imply the opposite.¹⁷

A later CAC document points the other way. AllBright reports that the second edition of its assessment guide, in 2024, added Article 3(2) processing to its list of data exports.²⁷

That doesn’t settle your case. AllBright says the guide gives no clear answer where no other Chinese party is involved.²⁷ Deheng points out that no domestic handler then exists to carry out a filing.²⁸ We read these commentaries, not the guide or its later third edition.

Hunton’s summary of the CAC’s Q&A of July 24, 2026 doesn’t address direct collection, and we didn’t read the Q&A itself.¹⁸

It does cover separate consent: it must be specific, can’t be bundled, and can come by pop-up, signed document, or reply by email or text.¹⁸

Paul Weiss reports the same logic from the court: a checkbox on a general policy doesn’t count.⁵

If a Chinese partner gathers your leads, see selling without being in China and working without a Chinese company.

What’s the real risk for a foreign company?

The maximum is severe, but the cases we read involve companies with a link to China. Here’s what Article 66 and Article 42 provide:¹

Situation	Consequence
Any breach	Correction order, warning, confiscation of illegal gains, suspension of an offending app
Refusal to correct	Up to RMB 1 million, plus RMB 10,000 to 100,000 for those responsible
Serious case	Up to RMB 50 million or 5% of prior-year turnover, possible business suspension, plus RMB 100,000 to 1 million for those responsible
Foreign entity harming rights of Chinese citizens	Listing that restricts data being provided to it (Art. 42)

And here’s what has actually been reported:

Case	Who	Outcome
Guangzhou Internet Court, published 2024	French hotel group, with Shanghai affiliate as co-defendant	Written apology, deletion, RMB 20,000 34
Shanghai CAC, May 2025	Shanghai affiliate of a luxury brand	Penalized, amount not given by DLA Piper 19
Shanghai CAC, 2025 cases	Multinational, listed by DLA Piper among “domestic enterprises” in the hotel and property sectors	Fined for breaching a transfer assessment decision, amount not given 19
Shanghai CAC, June 2026	Ctrip, based in Shanghai	RMB 10 million and a correction order 19

We found no CAC penalty against a foreign company with no presence in China. DLA Piper adds that other provincial offices don’t publish cases the way Shanghai does.¹⁹ Absence from our reading isn’t proof of safety, and it isn’t a compliance plan.

The Guangzhou case came from one customer suing, so a regulator isn’t the only route. Article 70 also lets prosecutors and designated organizations sue when many people are affected.¹

What to ask a local adviser

Bring these questions, with a list of what your pages collect:

1. Do my Chinese pages meet Article 3, given what I sell and how?
2. Do I need an Article 53 representative, and who can fill that role?
3. Does my form count as a cross-border transfer, or as direct collection?
4. Which legal basis fits an enquiry, and which needs consent?
5. What should my Chinese privacy notice and cookie handling look like?

Our China-ready website checklist helps you gather the facts first. If you sell to people in China, plan for this before launch rather than after.

The bottom line

If your pages seek clients in China and collect their data, plan as if PIPL applies, wherever your server sits.

Start with what you control: fewer fields, a clear Chinese notice and separate marketing consent.

Take the representative and transfer questions to a local adviser, because the published guidance doesn’t settle them.

How Index in China can help

We translate sites into Simplified Chinese with a human reviewer and work on getting them indexed by Chinese search engines.

We don’t give legal advice, and we’ll tell you when your case needs a local adviser. See what we do or book a 30-minute call.

Book a 30-minute call

Monthly report BaiduIndexed Bing ChinaIndexed SogouIndexed