CHINA Trends and Developments Contributed by: Vincent Wang, Xinyao Zhao and Alfred Feng, Global Law Office
that need to design the label for AI-generated con - tents in practice. Law enforcement and judicial judgments More frequent inspections on apps, mini programs and software development kits (SDKs) The governmental authorities continue carrying out compliance inspections on publicly available apps, mini programs and SDKs to enforce personal informa - tion protection laws. If the issues raised are not miti - gated on time (usually from two weeks to one month), the authorities will take the apps, mini programs and SDKs down from the app stores. The most common non-compliance issues include the following: • inadequate privacy policies; • illegal collection of personal information; • excessive device permission requests; and • failure to respond to individuals’ requests to uphold their personal information rights. Judicial cases concerning AI indicate the obligation of service providers Following the trend in 2024, judicial cases concern - ing AI are also on the rise in China in 2025, especially involving copyright issues. In 2024, several cases ruled that the AIGC tool provider was found liable for infringing the copyright of certain IP due to not exer - cising a “reasonable duty of care”. In 2025, a similar case in Shanghai ruled that the AIGC tool provider did not incur liability. In this case, the plaintiff was the IP owner, and a user of the AIGC tool uploaded around 20 pictures of the copyrighted contents to the platform, used the LoRA training func - tion of the tool and generated a LoRA model of the IP, which can produce pictures of the IP contents. Both the user and the AIGC tool provider were sued by the plaintiff for infringement of copyright. The court ruled that the AIGC tool provider incurred no liability because the AIGC tool provider had notified the user about their own obligation, designed a mechanism to receive complaints, and delisted the related LoRA model after receiving infringement notice from the plaintiff. Therefore, the court considered that the AIGC
tool provider had taken necessary measures and was not liable for infringement. This case demonstrates that the AIGC tool provider may avoid legal liabilities by establishing necessary risk control measures. The practice of the AIGC tool provider in such cases can be taken as a reference for similar service providers. The first case on MNCs for non-compliant cross- border transfer of personal information In September 2025, Shanghai authorities issued an administrative punishment against a famous global luxury brand’s affiliate in Shanghai, for three illegal activities: • customer personal information was transferred overseas without completing the cross-border mechanism; • customers were not fully informed about the cross- border data transfer, and separate consent was not obtained; and • technical security measures such as encryption and de-identification were not implemented. The announcement published by the authorities is short and did not disclose much information. Accord - ing to a piece of public information, in May 2025, the luxury brand was reported to have had a data leak by multiple media and its customers in China also received relevant text alerts. Such a leak may be the reason the authorities started an investigation and discovered the compliance defects regarding cross- border data transfer. Despite the authorities long reminding businesses about complying with the cross-border mechanism, there were few penalty cases in practice for non- compliance with such a statutory requirement. This case shows that Chinese authorities have started to check and punish multinational businesses for not being compliant with the cross-border mechanism. Those who have not fulfilled their obligations under such a mechanism should rectify the non-compliance as soon as possible.
68 CHAMBERS.COM
Powered by FlippingBook