PIPL

Overview

The PIPL is one of three pillars of China's data governance framework alongside the Cybersecurity Law and Data Security Law. For websites, non-essential cookies must be blocked until visitors actively opt in. Simply stating cookie use in a privacy policy is insufficient. Separate consent is required for sensitive data, cross-border transfers, and third-party data provision.

What This Means for Your Website

• Prior, informed, specific consent is required before placing any non-essential cookies on Chinese visitors
• Separate consent is needed for sensitive data processing, cross-border transfers, public disclosure, and third-party provision
• Foreign organizations serving Chinese users must establish a dedicated entity or appoint a representative in China
• Data localization requirements apply for critical information infrastructure operators
• Cross-border transfers require security assessment, standard contracts, or certification

Key Requirements

The CAC enforces the PIPL with penalties up to 50 million RMB or 5% of previous year's revenue for major violations. Organizations may also face business restrictions, suspension, and personal liability for responsible personnel. The tri-path framework for cross-border transfers (security assessment, standard contracts, certification) was completed in 2026.

How ConsentStack Handles This

ConsentStack blocks all non-essential cookies for Chinese visitors until active opt-in consent is given, with separate consent mechanisms for cross-border data transfers and third-party data sharing.