Provisions on the Administration of Deep Synthesis of Internet Information Services — Full English Translation (2023)

Issued by the Cyberspace Administration of China, the Ministry of Industry and Information Technology, and the Ministry of Public Security on November 25, 2022 (Order No. 12 of the Cyberspace Administration of China)

Effective: January 10, 2023

Table of Contents

Chapter I — General Provisions

Article 1 — These Provisions are formulated in accordance with the Cybersecurity Law of the People’s Republic of China, the Data Security Law of the People’s Republic of China, the Personal Information Protection Law of the People’s Republic of China, the Provisions on the Administration of Internet Information Services, and other laws and administrative regulations, for the purpose of strengthening the administration of deep synthesis of internet information services, promoting the healthy development of deep synthesis services, safeguarding the lawful rights and interests of citizens, legal persons, and other organizations, and maintaining national security and the public interest.

Article 2 — These Provisions shall apply to the provision of deep synthesis services of internet information within the territory of the People’s Republic of China. For the purposes of these Provisions, “deep synthesis technologies” refers to technologies that use generative synthesis algorithms such as deep learning and virtual reality to produce textual, image, audio, video, virtual scene, and other types of internet information.

Article 3 — The State internet information department shall be responsible for the overall coordination of the supervision and administration of deep synthesis services of internet information nationwide. The State Council departments for telecommunications, public security, culture and tourism, radio and television, and other relevant departments shall, in accordance with their respective functions and duties, carry out the supervision and administration of deep synthesis services of internet information. Local internet information departments shall, in accordance with their functions and duties, be responsible for the supervision and administration of deep synthesis services of internet information within their respective administrative regions. Local telecommunications, public security, and other relevant departments shall, in accordance with their respective functions and duties, carry out the supervision and administration of deep synthesis services of internet information within their respective administrative regions.

Article 4 — Providers and users of deep synthesis services shall comply with laws and regulations, respect social morality and public order, adhere to the correct political direction, public opinion orientation, and value orientation, and promote the Core Socialist Values.

Article 5 — Relevant industry organizations shall strengthen industry self-discipline, establish and improve industry standards, industry guidelines, and self-discipline management systems, urge and guide deep synthesis service providers to formulate and improve service norms, provide deep synthesis services in accordance with law, and enhance the overall quality of services.

Chapter II — Obligations of Deep Synthesis Service Providers

Article 6 — Deep synthesis service providers shall implement responsibilities relating to information security, establish and improve management systems for user registration, algorithm mechanism review, scientific and technological ethics review, information release review, data security, personal information protection, anti-telecommunications and online fraud, emergency response, and other management systems, and shall have secure and controllable technical support measures.

Article 7 — Deep synthesis service providers shall strengthen the management of deep synthesis content and adopt technical or manual methods to review the data input and synthesis results of deep synthesis service users. Deep synthesis service providers shall undergo security assessment in accordance with the relevant provisions of the State when providing deep synthesis services that have the attribute of public opinion or the capacity for social mobilization.

Article 8 — Deep synthesis service providers shall use models and templates for generating or editing biometric information such as human faces and voices, and non-biometric information such as special object names and specific scenes that may involve national security, national image, the public interest, and the lawful rights and interests of citizens, only after conducting security assessments in accordance with law.

Article 9 — Deep synthesis service providers shall authenticate the real identity information of deep synthesis service users based on mobile phone numbers, identity document numbers, unified social credit codes, or other means, in accordance with the provisions of the Cybersecurity Law of the People’s Republic of China. Deep synthesis service providers shall not provide services to users who do not provide real identity information in accordance with law.

Article 10 — Deep synthesis service providers shall strengthen the management of technical support providers and content providers, and shall sign agreements with them to clarify the rights and obligations of both parties in relation to data security, personal information protection, and other matters.

Article 11 — Deep synthesis service providers shall strengthen the management of training data and adopt necessary measures to ensure the security of training data. Training data shall not contain illegal or harmful information. Where training data contains personal information, the provisions of laws and administrative regulations on the protection of personal information shall be complied with.

Article 12 — Deep synthesis service providers shall strengthen the management of the generation or editing of biometric information such as human faces and voices and other content involving personal information. Where deep synthesis service content may cause confusion or misidentification by the public, the deep synthesis service provider shall add conspicuous identifications in a reasonable position and area of the generated or edited information content, to inform the public of the deep synthesis situation. The specific provisions on the method and scope of use of such identifications shall be separately formulated by the State internet information department and other relevant departments.

Article 13 — Deep synthesis service providers providing services such as intelligent dialogue, synthetic human voices, human face generation, immersive simulation scenes, and other services that generate or significantly alter information content shall, in conspicuous positions or areas of the generated or edited content, add identifications that are not easily confused or misidentified by users. Where the functions of deep synthesis services may cause confusion or misidentification by the public, the deep synthesis service provider shall add conspicuous identifications in a reasonable position and area to inform the public of the deep synthesis situation.

Article 14 — Deep synthesis service providers providing services such as synthesized human voices and human face generation that involve editing of personal information or other content that may cause confusion or misidentification by the public shall obtain the consent of the relevant individual or legal guardian thereof.

Article 15 — Deep synthesis service providers shall establish and improve mechanisms for handling public complaints and reports, publish complaint and reporting methods, and accept and handle public complaints and reports in a timely manner.

Article 16 — Where deep synthesis service providers discover that users are using deep synthesis services to produce, copy, publish, or disseminate illegal or harmful information in violation of laws and administrative regulations, they shall take measures such as warning, restricting functions, suspending services, or closing accounts in accordance with law and in accordance with the service agreement, and shall preserve relevant records and report to the relevant competent authorities.

Article 17 — Deep synthesis service providers shall establish and improve an algorithm disclosure mechanism, and where the types and basic principles of the algorithms used in their deep synthesis services are required to be disclosed, such disclosure shall be carried out in accordance with law. Deep synthesis service providers shall ensure that their algorithms do not set up models that induce users to become addicted or over-consume, and shall not use algorithms to implement unreasonable differential treatment or engage in any other act in violation of laws and regulations.

Article 18 — Deep synthesis service providers shall follow the principles of openness, fairness, and impartiality in formulating platform rules, and shall improve the efficiency and quality of services. Deep synthesis service providers shall provide necessary technical support and assistance to the relevant competent authorities in performing their duties of supervision and administration in accordance with law, and shall not destroy or conceal any evidence related to illegal acts.

Chapter III — Supervision and Administration

Article 19 — Internet information departments and other relevant departments shall, in accordance with their functions and duties, carry out supervision and inspection of deep synthesis services of internet information. Deep synthesis service providers shall cooperate with the supervision and inspection carried out by the relevant departments in accordance with law and provide necessary technical, data, and other support and assistance.

Article 20 — Where deep synthesis service providers provide deep synthesis services that involve major problems such as security risks, they shall promptly take measures such as suspension of services, modification, and improvement, and report to the relevant competent authorities.

Article 21 — Internet information departments and other relevant departments shall, in accordance with their functions and duties, carry out supervision and inspection of deep synthesis services, and where it is necessary to conduct security assessments of deep synthesis services of internet information, the relevant deep synthesis service providers shall be organized to carry out such assessments. Deep synthesis service providers shall cooperate with the security assessments organized by the relevant departments.

Chapter IV — Legal Liability

Article 22 — Where deep synthesis service providers violate the provisions of these Provisions, the internet information departments and other relevant departments shall, in accordance with their functions and duties and based on the Cybersecurity Law of the People’s Republic of China, the Data Security Law of the People’s Republic of China, the Personal Information Protection Law of the People’s Republic of China, the Provisions on the Administration of Internet Information Services, and other laws and administrative regulations, impose penalties. Where laws or administrative regulations do not provide for penalties, the internet information departments and other relevant departments shall, in accordance with their functions and duties, issue a warning to the deep synthesis service provider, circulate a notice of criticism, and order it to make corrections within a prescribed time limit. If it refuses to make corrections or the circumstances are serious, it shall be ordered to suspend information updates, and a fine of not less than 10,000 yuan but not more than 100,000 yuan shall be imposed. Where the case constitutes a violation of public security administration, public security administration penalties shall be imposed in accordance with law. If the case constitutes a crime, criminal liability shall be investigated in accordance with law.

Article 23 — Where deep synthesis service providers violate the provisions of these Provisions, thereby causing damage to the lawful rights and interests of others, they shall bear civil liability in accordance with law. Where the case constitutes a violation of public security administration, public security administration penalties shall be imposed in accordance with law. If the case constitutes a crime, criminal liability shall be investigated in accordance with law.

Chapter V — Supplementary Provisions

Article 24 — For the purposes of these Provisions, “deep synthesis service providers” refers to entities or individuals that provide deep synthesis services of internet information. “Deep synthesis service users” refers to entities or individuals that use deep synthesis services to produce, copy, publish, or disseminate information.

Article 25 — These Provisions shall be effective as of January 10, 2023.