Pushing the Envelope? The CAC’s Draft Regulations on Push Notifications

Introduction

On 2 March 2022, the Cyberspace Administration of China (“CAC”) issued draft regulations on the administration of internet pop-up push notifications (the “Draft Regulations”). The Draft Regulations were issued pursuant to a number of laws, including the Cybersecurity Law.

The Draft Regulations bid to further tighten government control over the news followed a human trafficking controversy that erupted on Chinese social media after a woman was found chained by the neck in Xuzhou last month, and the invasion of Ukraine.

However, the regulations also address other aspects of push notifications – including prohibition of algorithmic models that profile minor users and encourage user addiction. This is in keeping with the Chinese government’s broader efforts to reduce the influence of Big Tech, and aligns with the recently issued Internet Information Service Algorithmic Recommendation Management Provisions that came into force on 1 March 2022.

The Draft Regulations

(a) Scope of Application

The Draft Regulations apply to all owners and operators of operating systems, terminal devices, application software, websites and other such services (Service Providers) that provide push notification services (Push Notification Service Providers) in China.

(b) Types of Prohibited Information

Various categories of prohibited information in push notifications include:

1. illegal and negative information as defined in the Provisions on Ecological Governance of Network Information Content (the Provisions) that includes content that¹:
   1. opposes the basic principles established by the constitution;
   2. endangers national security, divulges state secrets, subverts state power, or undermines national unity;
   3. harms national honour and interests;
   4. distorts, defames, desecrates or negates the deeds and spirit of heroes and martyrs, or infringes upon the names, likenesses, reputations, or honors of heroes and martyrs by insulting, slandering, or otherwise;
   5. advocates terrorism or extremism or incites the commission of terrorist or extremist activities;
   6. incites ethnic hatred or ethnic discrimination, undermining ethnic unity;
   7. undermines the state’s religious policy and advocating cults and feudal superstitions;
   8. spreads rumors and disrupts economic and social order;
   9. spreads obscenity, pornography, gambling, violence, murder, terror, or instigating crimes;
   10. insults or slanders others, infringes upon the reputation, privacy, and other lawful rights and interests of others;
   11. uses exaggerated headlines, where the content is seriously inconsistent with the title;
   12. hypes up scandals, bad deeds, and so forth;
   13. improperly comments on natural disasters, major accidents, or other disasters;
   14. with sexual innuendo, sexual provocation, or other such elements that are likely to cause people to have sexual associations;
   15. displays bloody, frightening, cruel, or other such acts that cause people physical or mental discomfort;
   16. incites crowd discrimination, regional discrimination, and so forth;
   17. promotes vulgar or kitsch content;
   18. that might cause minors to imitate unsafe conduct, conduct that violates social morality, induce minors to have bad habits, and so forth;
   19. other content that has a negative impact on the network ecology; or
   20. other content prohibited by laws or administrative regulations;
2. information that violates public order and good customs, such as malicious speculation, entertainment gossip, extravagance and ostentation of wealth, and distasteful information²;
3. information that maliciously stirs up old news³;
4. content that hypes up sensitive events, exaggerate vicious content and disasters, and incites social panic⁴.

Push notifications containing news reports are required to adhere to additional rules, including a requirement for the source of news to come from the list of 1,358 government-approved news sources published by the CAC in October 2021⁵.

This means that news reports from unlicensed sources such as private institutions and individuals cannot be included in push notifications.

Accordingly, Push Notification Service Providers need to ensure that push notifications of news reports do not alter the original meaning and content of sanctioned headlines and are traceable to the original source. They are also required to obtain approval from the relevant source before publishing news content in push notifications⁶.

Collectively, these prohibitions are very broad and enhance the risks of breaching the law when pushing prohibited news-related notifications – or information that may be construed to fall within the above categories.

(c) Responsibilities of Push Notification Service Providers 

Push Notification Service Providers will be required to put additional processes in place in order to comply with the Draft Regulations.

One such requirement is for them to set up a manual review system⁷ for the review of screening, editing, pushing of content and other related work processes. Together with the content prohibitions highlighted in (b), they have to review the guidelines, policies and processes that they have in place when vetting pushed content.

Push Notification Service Providers are also expected to prioritise user protection and to:

1. clearly inform subscribers of the content and frequency of their push notifications, as well as how subscriptions to their push notifications can be cancelled⁸;
2. refrain from differentiating between ordinary users and users who are members when determining the frequency of their push notifications⁹;
3. not interfere with users closing pop-up push notification windows¹⁰;
4. clearly display the identity of the relevant Push Notification Service Provider in push notifications¹¹;
5. conspicuously mark “advertisements” to notify users of their nature¹²;
6. allow notifications for advertisements to be closeable with one click¹³;
7. prohibit push notifications that contain links or QR codes to third-party sources¹⁴; and
8. establish complaint and reporting avenues¹⁵.

The Draft Regulations also provide further guidance on the use of algorithmic models for push notifications¹⁶, in concert with the Internet Information Service Algorithmic Recommendation Management Provisions that came into force earlier in March.

This prohibits Push Notification Service Providers from using algorithms which induce users to consume excessively, violate laws and regulations and are not ethical, or abusing personalised push notifications such as leveraging algorithms to block or over-recommend information.

To protect minors, algorithms must not be abused to target minors or to subject minors to information that adversely affects their physical or mental health.

(d) Penalties

Penalties under the Draft Regulations include warnings, fines, suspension of push notifications and even suspension of business operations.

Conclusion 

The Draft Regulations apply not just to news organisations but to all Push Notification Service Providers – including any service providers with a mobile application, such as shopping centres, banks, gaming companies, food delivery companies, etc.

In summary, all companies with websites accessible in China, or mobile applications downloadable from PRC mobile application stores, should review their use of push notifications and associated policies, processes and guidelines.

The authors would like to thank Vanessa Leigh, Trainee Solicitor at Mayer Brown, for her assistance with this Legal Update.

¹ Art 6, 7 of the Provisions.

² Art 5(2) of the Draft Regulations.

³ ibid.

⁴ Art 5(5) of the Draft Regulations.

⁵ http://www.cac.gov.cn/2021-10/18/c_1636153133379560.htm 

⁶ Art 5(3) of the Draft Regulations.

⁷ Art 5(6) of the Draft Regulations.

⁸ Art 5(7) of the Draft Regulations.

⁹ ibid.

¹⁰ ibid.

¹¹ ibid.

¹² Art 5(9) of the Draft Regulations.

¹³ ibid.

¹⁴ Art 5(10) of the Draft Regulations.

¹⁵ Art 6 of the Draft Regulations.

¹⁶ Art 5(8) of the Draft Regulations.