China - Algorithmic Recommendation Regulation (Order No. 9)

Overview

The "Provisions on the Administration of Algorithmic Recommendation in Internet Information Services" (互联网信息服务算法推荐管理规定) were jointly promulgated by the Cyberspace Administration of China and three other ministries on 31 December 2021 and took effect on 1 March 2022. The regulation targets internet information service providers that apply algorithmic recommendation techniques within the territory of the People's Republic of China and establishes a risk-based, graded governance system that combines centralized coordination by the national and local Cyberspace Administration of China (CAC) with duties for sectoral agencies (MIIT, MPS, SAMR). It requires providers to publish algorithm rules, provide user choice including the ability to turn off personalized recommendation, protect vulnerable groups (minors, elderly, workers), implement audit and ethics review mechanisms, retain records and cooperate with security assessments and inspections. The regulation also prescribes filing requirements for services possessing public-opinion attributes or social-mobilization capacity and prescribes administrative sanctions for non-compliance.

Definitions

Key terms in the Provisions include "algorithmic recommendation service" (应用算法推荐技术提供互联网信息服务), which covers algorithm types such as generation/synthesis, personalized push, sorting/selection, retrieval/filtering and scheduling/decision-making. "Algorithm recommendation service provider" refers to any entity that offers such services within China. The regulation distinguishes services by attributes including "public-opinion attributes" and "social mobilization capability" to determine filing and assessment obligations. Other defined concepts include user models, user tags, algorithm mechanism (模型/机理), and algorithm filing and assessment processes used by national and local authorities to assess risk and supervise providers.

Governance and Institutional Framework

The Provisions establish a centralized but multi-agency supervision architecture. The national-level Cyberspace Administration is charged with overall coordination and national supervision while relevant ministries — notably the Ministry of Industry and Information Technology (MIIT) — the Ministry of Public Security and the State Administration for Market Regulation (SAMR) exercise supervisory roles within their statutory competencies. Local CAC offices coordinate regional governance. The Provisions require cross-departmental cooperation for filing, security assessment, inspections, logs analysis and enforcement. Authorities will build a graded-classified management system and a filing platform to receive reports and disclosures; completed filings must be published and providers must display filing numbers prominently on service interfaces. The national CAC is responsible for guidance and interpretation alongside the joint issuing ministries.

Key Focus Areas

The regulation centers on a number of policy goals and operational controls. First, content governance and mainstream value orientation: providers must prevent algorithms from promoting illegal or morally harmful content, optimize recommendation mechanisms to promote "positive" content and prevent the spread of unlawful information. Second, user rights and choice: providers must make clear that algorithmic recommendations are used and must provide an easy-to-use option either to select a non-personalized alternative or to disable personalized recommendations; they must also provide mechanisms to view, select or delete user tags used in recommendations. Third, safety and ethics: providers must set up internal algorithmic audits, ethics review and technical measures for data security and personal information protection. Fourth, special protections for specific groups and contexts: minors, elderly, laborers (scheduling), consumers (pricing), and news services face bespoke restrictions (e.g., no algorithmic dissemination of fake news). Fifth, accountability and documentation: providers must maintain logs and records, periodically audit algorithmic mechanisms, and be prepared to supply information during official security assessments. Sixth, filing and graded supervision: services with public-opinion attributes/social mobilization capability must register through the filing system, and those services may be subject to security assessment and heightened oversight. Collectively, these focus areas aim to shape platform design choices, operational transparency, risk mitigation and responsiveness to regulator-led supervision.

Implementation Framework

Implementation obligations are a mix of operational requirements and procedural compliance. Providers must (i) publish algorithm rules and basic operational principles in an accessible location, (ii) adopt and document algorithm mechanism audits, ethics reviews and security measures, (iii) provide user-facing options to disable personalization and to manage tags, (iv) implement content screening capability including feature libraries for illegal and harmful content, (v) take immediate measures to stop transmission of discovered illegal content and preserve records and (vi) where the service has public-opinion attributes or social mobilization potential, file required information, including a provider self-evaluation report, within ten working days. Completed filing must be processed within 30 days by the body receiving filings and a filing number will be issued and made public. Providers are required to retain network logs and cooperate with security assessments by authorities; they must also have accessible user complaint, reporting and appeals channels and respond within prescribed times. The regulation emphasizes both technical measures (e.g., de-duplication and intervention strategies, explainability improvements) and governance measures (e.g., personnel, policies, documentation and public disclosure).

Monitoring and Evaluation

The Provisions require regulators to adopt a graded and categorized monitoring system based on multiple criteria: public-opinion attributes/social mobilization capacity, content category, user scale, importance of processed data, and the degree of intervention in users' behavior. National and local CAC offices will work with telecom, police and market regulators to conduct security assessments and compliance checks. Providers must assist with evaluations by providing logs, materials and technical support. Authorities must complete filing reviews within prescribed timeframes (30 days for complete materials) and may require remediation where deficiencies are found. There are provisions to maintain confidentiality for personal and commercial secrets learned during assessments. The monitoring approach is both preventive (filing, self-evaluation reports, security assessments) and reactive (complaints handling, inspections, sanctions and remediation). Periodic audits and verification of algorithmic models, data sources, and outcomes are expected parts of the monitoring regime.

Penalties, Liability, and Appeals

The Provisions set administrative penalties for breaches and provide for escalation depending on the nature and gravity of violations. For violations of specified articles (including failure to adopt governance measures, failure to publish rules, failure to provide user options, failure to file where required, and failure to mark generated content), regulators may issue warnings, public criticism, orders to correct and fines between RMB 10,000 and 100,000; serious or continuing breaches can lead to orders to suspend updates, closure of services, revocation of licenses or business permits, and referral to criminal investigation where acts constitute crimes. Filing obtained by deception may be revoked and punished. Powers are allocated to CAC and to telecom, public security and market regulators within their legal remit. The Provisions also create user-facing redress mechanisms (complaints and appeals to regulators) and require providers to maintain effective complaint-handling channels. While the text sets administrative monetary and business penalties, criminal liability remains available under general criminal law for severe unlawful acts.

Relationship to Other Instruments

The Provisions are expressly designed to be implemented consistent with the Network Security Law, the Data Security Law and the Personal Information Protection Law, and reference the Internet Information Service Management Measures and other sectoral rules. They build upon earlier inter-ministerial guidance on algorithm governance published in 2021 and interact with subsequent sectoral measures such as rules concerning deep synthesis (deepfake) content, large-model registration/filing, and industry-specific safety assessments. The Provisions operate as a departmental regulation with interpretation and enforcement roles shared by the joint issuing bodies; where more specific legal provisions or administrative regulations exist, those take precedence. The Provisions also integrate with administrative filing, telecommunications regulation, public-security investigations of unlawful content, and market supervision for competition and consumer protection issues.

International Alignment

While the Provisions are tailored to Chinese statutory and policy priorities — notably emphasis on mainstream values, national security, and social stability — several themes align with international regulatory trends: risk-based classification, transparency and user choice, logging and record-keeping for oversight, protections for minors and vulnerable groups, and obligations for safety assessment and audit. However, unlike some international instruments that center individual data protection rights as the primary axis (e.g., EU GDPR), the Provisions emphasize social governance goals and state-led oversight, with cross-agency supervision and mandatory filing for services with public-opinion attributes. The rules are part of a broader global move to regulate algorithmic systems but reflect China’s specific governance model and administrative structure; cross-border actors offering services in China must adhere to these domestic requirements and filing/assessment obligations where their services are provided in-country.

Implementation Timeline

Sources and References