What Is the PIPL?
China's data protection legislation, known as the Personal Information Protection Law (PIPL), took effect on November 1, 2021. As the country's first comprehensive framework dedicated to personal information protection, PIPL forms one of the three pillars of China's data governance regime alongside the Cybersecurity Law (2017) and the Data Security Law (2021).
PIPL altered the rules for organizations that use clickwrap agreements with users in China. Distinctive to the law are the separate consent doctrine for sensitive data and cross-border transfers (Articles 23, 25, 29, 39), strict cross-border transfer mechanisms requiring a Cyberspace Administration of China (CAC) security assessment or standard contract, and an enforcement regime among the heaviest globally, with maximum fines of up to 5% of annual revenue and personal liability for responsible managers.
Who Does PIPL Apply To?
PIPL applies to the processing of personal information of natural persons within the People's Republic of China, regardless of whether the handler is domestic or foreign. Article 3 grants the law explicit extraterritorial reach.
PIPL is applicable when an entity:
- Processes personal information of individuals located in China.
- Provides products or services to individuals within China from outside the country.
- Analyzes or assesses the behavior of individuals within China.
- Operates in any other circumstance prescribed by Chinese law.
Foreign entities subject to PIPL must establish a dedicated institution or appoint a representative within China and report its details to the CAC. There is no small-business exemption.
PIPL and Clickwrap Agreements
PIPL imposes specific requirements on how consent is collected through clickwrap agreements. Articles 13, 14, 17, and 29 establish that consent must be voluntary, explicit, and given on a fully informed basis, with separate consent required for sensitive data, cross-border transfers, public disclosure, and certain third-party sharing. Each condition carries direct implications for clickwrap design, disclosure, and recordkeeping.
How PIPL Affects Clickwrap Design
Article 14 defines consent as a voluntary, explicit indication given by the individual on a fully informed basis for a specific and clear purpose. Article 15 grants individuals the right to withdraw consent at any time and requires that handlers provide a convenient mechanism for withdrawal. In a clickwrap context, this means an unbundled consent action paired with a one-click withdrawal at least as accessible as the original acceptance.
Separate consent is the defining feature of PIPL. Article 28 defines sensitive personal information to include biometric characteristics, religious beliefs, specially-designated status, medical health, financial accounts, individual location tracking, and the personal information of minors under 14, and Article 29 requires the individual's separate consent before any such handling. Article 39 imposes the same requirement for cross-border transfers, while Articles 23 and 25 extend separate consent to provision of personal information to other handlers and to public disclosure. A single "I agree" checkbox cannot legally cover both general processing and any of these scenarios. Each requires its own consent element, such as a distinct checkbox, a dedicated confirmation screen, or a separate workflow step that is independently actionable.
Consent must not be coerced or conditioned. Article 16 prohibits handlers from refusing to provide products or services because an individual withholds or withdraws consent, except where processing is necessary for the service to function. A clickwrap that locks users out of core functionality after they decline marketing analytics or non-essential cross-border transfers violates this provision.
Article 6 requires that processing have a clear and reasonable purpose directly related to the processing objective, and that handlers adopt the method with the least impact on individual rights. Collection must be limited to the minimum scope necessary. Clickwrap agreements that request broad categories of data without linking each category to a stated purpose face regulatory scrutiny.
What Must Be Shown Under PIPL
Article 17 establishes the disclosure obligations that must be satisfied prior to any clickwrap consent action. Personal information handlers must inform individuals in conspicuous, true, and accurate language of:
- The name and contact details of the personal information handler.
- The purpose and method of processing for each category of personal information.
- The categories of personal information being collected, including the necessity for any sensitive data.
- The retention period, or the criteria for determining it.
- The means and procedures for exercising rights under Articles 44–48 (access, correction, deletion, portability, and withdrawal of consent).
For sensitive personal information under Article 30, the handler must additionally explain the necessity of processing and the impact on the individual's rights and interests as part of the separate consent flow, not buried in a general privacy policy.
For cross-border transfers under Article 39, the handler must inform the individual of the overseas recipient's name and contact information, the purpose and method of processing, the categories of personal information involved, and the means of exercising rights with the overseas recipient. All of this must be provided before the separate cross-border consent is captured.
What Records You Must Keep Under PIPL
Article 54 requires personal information handlers to regularly audit their processing activities, and Article 55 mandates a Personal Information Protection Impact Assessment (PIPIA) before any high-risk processing, including sensitive data, automated decision-making, cross-border transfers, and any processing with a significant impact on individual rights. Article 56 requires that PIPIA reports and processing records be retained for at least three years.
A defensible clickwrap consent record under PIPL must capture:
- Subject identity - Name, account ID, or another unique identifier verified at the consent action.
- Action timestamp - The exact date and time of each consent or withdrawal event.
- Consent type - Whether general or separate consent was obtained, and the specific Article 29, 39, 23, or 25 trigger.
- Disclosure presented - The Article 17 (and Article 30 or 39 where applicable) disclosure shown at the moment of consent.
- Terms version - The version of the privacy notice or terms in effect at the moment of consent.
- Withdrawal log - The date and scope of any consent withdrawal, plus confirmation that processing ceased for the affected purposes.
Cross-border transfer documentation carries additional obligations. Organizations transferring data under the CAC standard contract (Article 38) must retain the signed contract, the PIPIA conducted before the transfer, and records of any CAC security assessment, available for regulatory inspection and subject to the three-year minimum retention period.