Discussed and adopted by the Judicial Committee of the Supreme People’s Court; issued on August 28, 2025.
Keywords
Civil / protection of privacy and personal information / collection of user profile information / necessary for performing a contract / automated decision-making
Holding
1. In determining whether the processing of personal information falls within the scope of information “necessary for concluding or performing a contract to which the individual is a party,” the determination may be made in light of the provisions of relevant laws, regulations, rules, and regulatory documents concerning the scope of necessary personal information, as well as the type and content of the contract. Where the failure to process the relevant information would make it impossible to realize the basic functional services stipulated in the contract or the additional functional services autonomously selected by the user, the processing of the personal information may be found to be necessary for concluding or performing the contract; otherwise, it shall not be so found.
2. Where the collection of user profile information is not necessary for providing network services, and the login or registration interface of the website or software, when collecting such information, fails to provide the user with an alternative login method under circumstances where the user does not consent to submit the relevant information, the user’s provision of personal information does not constitute voluntary consent; where the user claims infringement of his or her personal information rights and interests, the people’s court shall support the claim in accordance with the law.
Basic Facts
[X] Technology Co., Ltd. (“[X] Technology Company”) operated an English learning website and two mobile applications.On January 15, 2021, [X] Technology Company, without obtaining Luo [X]’s consent, collected Luo [X]’s two mobile phone numbers through an offline cooperative experience store, created for Luo [X] an account and password for the English learning website in issue, and sent multiple pieces of relevant information to Luo [X]’s mobile phone.
On January 20, 2021, in order to understand the account situation, Luo [X] entered his mobile phone number and password on the login page of the English website and the mobile application in issue and clicked to log in, whereupon several question-and-answer interfaces appeared, requiring the user to fill in contents such as “occupation,” “purpose of study,” “stage of schooling,” and “English proficiency,” and the login process could not continue without filling in the relevant information. After completing this, the user also had to fill in a basic personal information interface and enter mandatory contents such as Chinese and English names before completing registration. During this process, there were no options such as “skip” or “refuse,” nor was there any prompt authorizing consent to the collection of personal information.
Luo [X] brought a lawsuit over a dispute concerning privacy and personal information protection, alleging that: the website and mobile application in issue did not inform him of the personal information collection policy, forcibly collected information such as Luo [X]’s mobile phone number and user profile, and used it beyond the scope, infringing his personal information rights and interests; at the same time, the website in issue sending marketing text messages to him without permission intruded upon the peace of his private life and infringed his right to privacy. In order to learn about [X] Technology Company’s processing of his personal information and to determine the scope of deletion, Luo [X] made a request to [X] Technology Company to consult and copy his personal information; [X] Technology Company provided relevant materials upon Luo [X]’s request, but Luo [X] considered that the system screenshots provided by [X] Technology Company were not timely or clear enough. On this basis, he requested the court to order [X] Technology Company to provide him with a clear copy of his personal information, cease the infringement, delete the personal information, make a public apology, and compensate for losses of RMB 2,900.
[X] Technology Company argued that: the personal information in issue was collected by the offline cooperative experience store with which it cooperated, and it had no subjective intent to unlawfully collect or process personal information or to intrude upon Luo [X]’s peace of life. The services provided by the website and mobile application it operated needed to recommend suitable content to users according to different user needs, that is, pushing information to users through automated decision-making was a basic functional service of its website and mobile application, and collecting user profile information for automated decision-making was necessary for providing the service, so it did not need to obtain the user’s individual consent. Moreover, Luo [X] actively filled in the information, and thereby actually consented to [X] Technology Company’s collection through his own active conduct. Therefore, [X] Technology Company’s collection of Luo [X]’s user profile information did not constitute infringement.Judgment
The Beijing Internet Court rendered the civil judgment (2021) Jing 0491 Min Chu No. 5094 on August 1, 2022, ordering [X] Technology Company to provide Luo [X] with a clear copy of his personal information; to cease processing Luo [X]’s personal information, including the two mobile phone numbers registered under his name and his user profile information, account and password information, and order information, and to delete the relevant personal information; to apologize to Luo [X] in writing; and to compensate for attorney fees and evidence-collection expenses totaling RMB 2,900. After the judgment was pronounced, [X] Technology Company appealed. The Beijing Fourth Intermediate People’s Court rendered the civil judgment (2022) Jing 04 Min Zhong No. 494 on November 28, 2022: the appeal was dismissed and the original judgment was affirmed.
Reasoning
The focus of dispute in this case was whether [X] Technology Company’s collection of user profile information on the ground of pushing information through automated decision-making fell within the statutory exception requiring no individual consent.
Article 1035 of the Civil Code of the People’s Republic of China establishes the “notification-consent” rule for the processing of personal information, and also provides for statutory exceptions to obtaining individual consent. Given that the relevant provisions of the Civil Code are relatively general, and that the Personal Information Protection Law of the People’s Republic of China had been promulgated and came into effect during the trial of this case, and [X] Technology Company defended itself on the basis of the relevant provisions of the Personal Information Protection Law, the relevant spirit of the Personal Information Protection Law was referred to in the trial of this case. Specifically, item 2 of paragraph 1 of Article 13 of the Personal Information Protection Law stipulates that information processing “necessary for concluding or performing a contract to which the individual is a party” is a statutory exception to obtaining individual consent. In determining what is “necessary for the contract,” the determination may be made in light of the provisions of relevant laws, regulations, rules, and regulatory documents concerning the scope of necessary personal information, as well as the type and content of the contract: if the absence of the information processing would make it impossible to realize the basic functional services stipulated in the contract or the additional functional services autonomously selected by the user, it may be found to be necessary for concluding or performing the contract; otherwise, it shall not be so found.
First, from the perspective of relevant industry norms, the Provisions on the Scope of Necessary Personal Information for Common Types of Mobile Internet Applications (Guo Xin Ban Mi Zi [2021] No. 14), issued by the Cyberspace Administration of China, the Ministry of Industry and Information Technology, the Ministry of Public Security, and the State Administration for Market Regulation, clearly stipulate that the basic functional services of learning and education applications are “online tutoring, online classes, etc.,” and that the necessary personal information is the registered user’s mobile phone number. Taking this as a reference, the mobile application in issue, as a learning and education application, did not include pushing information to users through automated decision-making among its basic functional services. Therefore, [X] Technology Company’s claim that collecting user profile information was the basis for providing its services, on the ground that its business model was to push information to users through automated decision-making, was without basis. In other words, user profile information was not necessary personal information for the mobile application in issue to provide services.
Second, from the perspective of product function design, information “necessary for performing the contract” should be limited to basic functional services or additional functional services that the user autonomously adds when given a choice. Only where the collected personal information has a direct connection with the basic functional services or the additional functional services autonomously selected by the user, and the lack of the relevant personal information would make it impossible to realize the service functions, does the collection fall within what is “necessary for performing the contract.” In this case, the basic functional service of the mobile application in issue was to provide online course video streams and relevant graphic, video, and other information; collecting user profile information was not necessary for its basic functional services, and there was no evidence that Luo [X] had autonomously chosen to use additional functional services. Therefore, [X] Technology Company’s act of directly collecting user profile information on the ground of realizing automated decision-making service functions had insufficient basis, did not constitute a statutory circumstance allowing it to process the user’s personal information without obtaining individual consent, and its collection of user profile information should have obtained Luo [X]’s consent.
Third, Article 16 of the Personal Information Protection Law provides: “A personal information processor shall not refuse to provide products or services on the ground that the individual does not consent to the processing of his or her personal information or withdraws consent; except where the processing of personal information is necessary for providing the products or services.” When the software in issue required the user to submit user profile information such as occupation type, stage of schooling, and English proficiency on the first login interface, it provided no options such as “skip” or “refuse,” and provided no alternative login method under circumstances where the user did not consent to submit the relevant information, making submission of the relevant information the only way to log in. Such product design would cause users who did not consent to the collection of the relevant information to have no choice but to check “agree” to provide the relevant information for the purpose of using the software; otherwise, they could only give up using the software in issue. In such circumstances, “agreeing” to provide personal information was actually made involuntarily by the user, and did not satisfy the requirement in paragraph 1 of Article 14 of the Personal Information Protection Law that “where personal information is processed based on individual consent, the consent shall be given voluntarily and expressly by the individual on the basis of full knowledge,” and did not produce the effect of obtaining individual consent.
In summary, [X] Technology Company, in the absence of a statutory exception to obtaining individual consent, collected Luo [X]’s user profile information without consent, infringing Luo [X]’s personal information rights and interests.
Relevant Legal Provisions
Article 1035 of the Civil Code of the People’s Republic of China.
Articles 13, 14, and 16 of the Personal Information Protection Law of the People’s Republic of China.
Disclaimer: This translation is provided for reference and informational purposes only. In the event of any discrepancy, the official Chinese text issued by the Supreme People’s Court shall prevail. This translation does not constitute legal advice.
Free PDF download of the complete article.
