AI-driven over-collection of personal data in China by mobile apps and services
China's State Network Security Notification Center reported that 71 mobile applications illegally collected personal information through forced authorization, while law enforcement uncovered an extensive gray market for trading leaked data from schools, hospitals, and other institutions.
What happened
The National Computer Virus Emergency Response Center detected 71 mobile applications engaging in unlawful and irregular collection and use of personal information.
Mobile apps employed forced authorization tactics including requiring information provision to use the application, demanding multiple unrelated permissions at once, and requesting personal information beyond the scope of their business activities.
Data breaches occurred through web scraping, trojan insertion, phishing links, and extraction of scattered information from public channels like e-commerce and recruitment sites, which was then cleaned, compiled into databases, and resold.
Taiyuan public security broke a case involving 'insiders' from schools, educational training institutions, and eye hospitals illegally disclosing citizen personal information, involving proceeds exceeding 220,000 yuan.
Reported impact
Users reported receiving unsolicited marketing calls shortly after registering accounts or using app features. One individual received numerous loan solicitation calls after clicking a lending app's credit limit inquiry button.
Residents expressed privacy concerns about facial recognition systems installed in residential communities for access control, worrying the information could be leaked. Insurance customers faced dozens of promotional calls daily from companies with detailed knowledge of their vehicle and policy information.
Index analysis
Experts stated that forced authorization represents a form of 'technical coercion' violating the principle of user consent, utilizing technical architecture and information asymmetry to compel data sharing.
Police investigation revealed personal data undergoes a complete gray market supply chain: initial collection, processing by fake IT consultants, distribution through shell companies posing as market research firms, and final sale to telecommunications fraud syndicates, loan push operations, and criminal groups.
Governance controls
The Personal Information Protection Law of China established a 'minimum necessity' principle requiring collection limits to only the information necessary to achieve the stated purpose.
The 2021 Supreme People's Court ruling on facial recognition clarified that residential building access systems cannot use facial recognition as the sole verification method and must provide alternative means such as card swiping.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.