How do you make a website compliant with Chinese law?
Making a website compliant in mainland China is first about legal permission, not speed. A site has to earn the right to operate before anything else: the correct ICP filing or commercial ICP license, held through a mainland legal entity and served from a host inside the mainland.
That permission sits under one umbrella — the Cybersecurity Law (revised 2025, in force January 1, 2026), with the Data Security Law and the Personal Information Protection Law building on it. In practice they create five obligations: licensing or filing, in-country hosting, lawful handling and cross-border transfer of personal information, network- and data-security grading (MLPS), and lawful content with real-identity checks where required.
This is a risk map, not a legal verdict — your exact duties turn on what you collect, your data volumes, and your role, so treat each item as a risk to confirm with counsel. Our China compliance team can map your obligations with you →
What actually makes a website compliant to operate in mainland China
| Fact | Primary source |
|---|---|
| Operating a website requires the right ICP registration. A non-commercial site must complete an ICP filing (备案); a commercial or paid service must hold a value-added telecom (commercial ICP) license. Without the correct one, operating the service is not permitted. | State Council Order No. 292 (Internet Information Services Measures), Arts. 3–4; MII Decree No. 33 (ICP Filing Measures), Art. 13 (gov.cn), retrieved 2026-10-08 |
| The filing attaches to an in-country host and a mainland legal entity. An ICP registration is granted through a mainland Chinese company and binds to a host physically inside mainland China, so an offshore-only deployment cannot carry a compliant filing. | MII Decree No. 33 (ICP Filing Measures); Cybersecurity Law, Art. 39 (in-country storage for CIIOs) (gov.cn), retrieved 2026-10-08 |
| Personal data of people in China falls under PIPL. Collecting it requires notice and consent, and moving it out of the mainland requires a separate consent plus one transfer mechanism — a CAC security assessment, the CAC standard contract, or certification — regardless of where your company is based. | Personal Information Protection Law, Chapter III (cross-border provision), Arts. 38–40 (NPC / CAC official text), retrieved 2026-10-08 |
| Network- and data-security duties apply on top. The Cybersecurity Law requires every network operator to meet the Multi-Level Protection Scheme (MLPS, "graded protection"), and the Data Security Law requires data to be classified by sensitivity and protected accordingly. | Cybersecurity Law (2016, amended 2025; in force 2026-01-01), Art. 23 (MLPS) and Art. 39; Data Security Law, Art. 21 — via our English translation, retrieved 2026-10-08 |
Sources verified by the 21YunBox compliance team on 2026-10-08.
Operating a website for mainland China is first a matter of legal permission, not speed. Before anyone measures how fast a page loads, the site needs the right to operate: the correct ICP filing or license, held through a mainland legal entity and served from a host inside the mainland. Performance, delivery, and availability all sit on top of that permission.
That permission sits under one framework. The Cybersecurity Law (CSL) — adopted in 2016 and revised in 2025, with the revision in force January 1, 2026 — is the umbrella statute, and the Data Security Law (DSL, effective September 1, 2021) and the Personal Information Protection Law (PIPL) build on it. For most websites the operational starting point remains the Measures for the Administration of Internet Information Services (State Council Order No. 292), effective September 25, 2000.
As is typical of the Chinese legal system, these rules are drafted broadly and are subject to interpretation by the enforcement authorities. Read together, they create five practical obligations for anyone operating a website that reaches users in mainland China. Treat the summary below as a risk map to confirm with qualified counsel, not as legal advice.
These five obligations are:
1. Licensing for China
Depending on what your website does — whether it merely presents information or sells products and services directly — you will need a different ICP registration for China.
As stated in Article 3 and Article 4 of the Measures for the Administration of Internet Information Services (State Council Order No. 292):
Internet information services are divided into two categories: commercial and non-commercial. Commercial Internet information services refer to the provision of information or web page creation and other service activities to Internet users through the Internet. Non-commercial Internet information services refer to service activities that provide open and shared information to Internet users for free through the Internet.
The state implements a licensing system for commercial Internet information services; and a filing system for non-commercial Internet information services. Those who have not obtained a license or have not performed the filing procedures shall not engage in Internet information services.
For example, a static website showcasing your business typically requires an ICP filing (备案), while shopping and e-commerce platforms need a commercial ICP license (a value-added telecom license). ICP stands for Internet Content Provider: an ICP registration is issued through the Chinese Ministry of Industry and Information Technology (MIIT) and is what legally allows a content provider to operate in China. The detailed procedure is set out in the ICP Filing Measures (MII Decree No. 33).
Crucially, the filing is not just paperwork. It is granted through a mainland Chinese legal entity and attaches to a host located inside mainland China — so a compliant in-country host and a lawful filing are two halves of the same requirement, and you cannot satisfy one without the other.
On enforcement, Article 19 of the Measures provides:
Anyone who violates the provisions of these regulations by engaging in commercial Internet information services without obtaining a business license, or providing services beyond the permitted items, shall be ordered by the telecommunications management agency of the province, autonomous region, or municipality directly under the Central Government to make corrections within a time limit. If there is no illegal income or the illicit income is less than 50,000 yuan, a fine of not less than 100,000 yuan but not more than 1 million yuan shall be imposed; if the circumstances are severe, the website shall be ordered to shut down.
If you are not sure which category your website falls into, we can help you identify which registration your business needs to stay within Chinese law.
2. Establish Effective Provisions to Protect User Information
Like the USA and other jurisdictions, China requires you to apply industry-standard safeguards to the data you hold. The baseline is the Multi-Level Protection Scheme (MLPS, or “graded protection”) established by the Cybersecurity Law: every network operator must grade its systems and meet the security obligations for that grade. On top of that, the Data Security Law requires you to classify data by sensitivity, protect it accordingly, and designate someone responsible for data security.
Ensure Your Website's Legal Compliance in China
Get a consultation on the five primary obligations you need to follow to keep your website compliant with Chinese regulations.
Get a Compliance Assessment3. Protect the User’s Right to Control Their Information
When your website collects personal information — for example by accessing location, contacts, camera, or microphone — you must give clear notice and obtain the user’s consent. These notice-and-consent duties are the core of the Personal Information Protection Law (PIPL), China’s dedicated personal-data statute, and for sensitive data or any transfer out of the mainland PIPL requires a separate, specific consent.
More broadly, any organization or individual collecting data must do so by lawful and proper means and must not steal it or obtain it through other illegal methods. Where laws and administrative regulations set the purpose and scope of collection, data must be collected and used only within that purpose and scope — a principle reinforced by the Data Security Law.
4. Data Localization
China requires certain data generated in-country to be stored on servers inside mainland China. As a general rule, operators that collect personal information in China should expect in-country storage to be the compliant default, and operators of critical information infrastructure (CIIOs) are explicitly required to store personal information and important data collected in China within the territory under the Cybersecurity Law.
The Data Security Law governs the outbound transfer of important data: for CIIOs it points back to the Cybersecurity Law, and for other processors to measures issued by the national cyberspace authority. Where personal information leaves the mainland, PIPL adds its own cross-border transfer requirements — notice, a separate consent, and one approved transfer mechanism (a security assessment, the standard contract, or certification).
The stakes are real. In July 2022, the Cyberspace Administration of China imposed a penalty of 8.026 billion yuan (about US$1.19 billion) on a major ride-hailing operator for violations spanning the Cybersecurity, Data Security, and Personal Information Protection laws, and barred it from registering new users during the investigation.
Because in-country storage is a legal requirement before it is a performance choice, this is where 21YunBox fits: we provide compliant, ICP-filed delivery and hosting inside mainland China so your users’ data can stay on Chinese soil — without you rebuilding or migrating your stack.
5. Record and Save User Log Information
As stated in Article 14 of the Measures for the Administration of Internet Information Services, providers of services such as news, publishing, and electronic bulletin boards must record the information they publish along with its release time and the Internet address or domain name; Internet access providers must record users’ access time, account, Internet address or domain name, and calling number.
These backup records must be kept for at least 60 days and produced when state organs make lawful inquiries. Alongside logging, the content itself must be lawful: categories such as gambling, fraudulent news, pornography, and politically prohibited material are banned or tightly restricted, and the Cybersecurity Law requires real-identity verification of users for many services, such as account registration and information publishing.
The Easiest Way
21YunBox is a China delivery and compliance overlay. Our team maps each of these five obligations to your specific stack, secures the right ICP filing or license through a mainland entity, and delivers your existing website or app from inside mainland China — compliant and fast, without a rebuild or migration. The licensing and data rules above are a risk picture, not legal advice, so we work alongside your counsel to confirm what applies to you. Contact us to see how we can help.
