New rules to regulate FR technology | China

On 21 March 2025, the Cyberspace Administration of China (CAC) and the Ministry of Public Security (MPS) jointly issued the Measures for the Administration of the Security of the Application of Face Recognition Technology (FR measures), which will take effect from 1 June 2025.

After almost two years since the CAC issued the first draft of the FR measures, in August 2023, for public comment, it has adopted a few notable changes in the measures that are aimed to:

1. Avoid excessive regulatory restraints on face information processing activities and the application of face recognition (FR) technology; and
2. Achieve a balance between face information security protection and relevant technological innovation and application.

The FR measures apply to the processing of face information by using FR technology within China. FR technology is expressly defined in the FR measures as the individual biometric recognition technology that uses face information to identify individual identity.

The FR measures typically apply to the following two categories:

1. 1. Verification of personal identity (matching between the collected face information and specific face information stored in the system). A typical example of use is a visitor entrance system using FR technology; and
   2. Identification of specific individual (matching between the collected face information against face information stored in a system within a specific scope). A typical example of use is a CCTV used for criminal detection where collected face information is compared against the fugitive database maintained by the MPS, or its local counterparts.

The FR measures do not apply to the use of FR technology to process face information for the purposes of: (1) engaging in FR technology research and development; or (2) algorithm training activities.

As the FR measures overlap with the relevant general requirements under the Personal Information protection Law (PIPL) and other applicable data protection laws to a large extent, it is unclear whether the above-mentioned exempted activities involving use of FR technology should still be subject to those relevant general requirements, but the authors tend to believe that those relevant general requirements should still be complied with.

The FR measures provide that the installation of any FR device in public places shall be necessary to protect public security, the face information collection area should be reasonably determined in accordance with the law, and the public shall be warned by means of conspicuous signs.

This echoes article 26 of the PIPL, and articles 9 and 13 of the Regulations on the Administration of Public Security Video Image Information Systems, issued by the State Council (effective from 1 April 2025). Furthermore, according to the PIPL, individuals’ separate consent is not required if the collected face information is only used for the purpose of maintaining public security and not for any other purposes.

Business Law Digest is compiled with the assistance of Baker McKenzie. Readers should not act on this information without seeking professional legal advice. You can contact Baker McKenzie by e-mailing Howard Wu (Shanghai) at [email protected]