Jointly released by the Cyberspace Administration of China (CAC) and the Ministry of Public Security, the measures will go into effect on June 1, 2025.
China's cyberspace regulator on Friday published regulations governing the use of facial recognition technology, separately stating that individuals should not be forced to verify their identity using such technology.
The document sets forth basic requirements and processing rules for the use of facial recognition technology in handling facial data, security standards for the application of the technology, as well as relevant supervisory and management responsibilities.
Notably, regarding mandatory facial recognition, an issue of wide concern which often occurs at hotel check-ins and residence area entrances, the document introduces a non-mandatory principle, stipulating that facial recognition cannot be the sole verification method if "the same purpose or business requirement can be achieved through other non-facial recognition methods."
The spread of facial recognition technology into everyday life in China has led to an increase in societal anxiety about privacy in recent years.
A survey conducted in 2021 by a think tank affiliated with state-run media outlet The Beijing News found that 75% of respondents were concerned about facial recognition and 87% opposed the use of the technology in public places of business.
Facial recognition data is sensitive personal information, and once it is leaked, it can cause significant harm to individuals' personal and property security, and even pose a threat to public safety, said an official with the CAC.
The measures were introduced as facial recognition becomes increasingly common across consumption, finance and transportation, thanks to the rapid development of internet technologies, according to the official.
While this has contributed to the growth of the digital economy and facilitated people's lives, it has also raised concerns about privacy and the leakage of personal information, drawing widespread attention from all sectors of society, the official said.
In November 2021, the Personal Information Protection Law took effect, mandating user consent for the collection of facial data and imposing heavy fines on non-compliant companies. The law also stipulates that national cyberspace authorities shall coordinate relevant authorities to formulate specific personal information protection rules for new technologies and applications, including facial recognition.
Rules for the processing of personal information have also been included in laws and administrative regulations such as the Cybersecurity Law, the Data Security Law and the regulations on network data security management.
Sources: China Daily, Reuters
