Measures for the Security Management of the Application of Facial Recognition Technology

Order of the Cyberspace Administration of China and the Ministry of Public Security of the People's Republic of China
(No. 19)

The Measures for the Security Management of the Application of Facial Recognition Technology, as deliberated and adopted at the 23rd Executive Meeting of the Cyberspace Administration of China for 2024 on September 30, 2024 and with the consent of the Ministry of Public Security, are hereby announced and will come into force on June 1, 2025.

Zhuang Rongwen, Director of the Cyberspace Administration of China
Wang Xiaohong, Minister of Public Security
March 13, 2025

Measures for the Security Management of the Application of Facial Recognition Technology

Article 1 For the purposes of regulating the activities of applying facial recognition technology to process facial information and protecting the rights and interests of personal information, these Measures are developed in accordance with the Cybersecurity Law of the People's Republic of China, the Data Security Law of the People's Republic of China, the Personal Information Protection Law of the People's Republic of China, the Regulations on Administration of Network Data Security, and other laws and administrative regulations.
Article 2 These Measures shall apply to the activities of applying facial recognition technology to process facial information within the territory of the People's Republic of China.
The provisions of these Measures shall not apply to application of facial recognition technology to process facial information for carrying out research and development of facial recognition technology and algorithm training activities within the territory of the People's Republic of China.
Article 3 Those who carry out the activities of applying facial recognition technology to process facial information shall comply with laws and regulations, respect social morality and ethics, abide by business ethics and professional ethics, be honest and trustworthy, fulfill obligations of protecting personal information, and assume social responsibilities, and shall not endanger national security, damage public interests, or infringe upon the legitimate rights and interests of individuals.
Article 4 Those who apply facial recognition technology to process facial information shall have a specific purpose and sufficient necessity, take the way that has the least impact on the rights and interests of individuals, and implement strict protection measures.
Article 5 Before applying facial recognition technology to process facial information, the personal information processor shall truthfully, accurately and completely inform the individual of the following matters in a prominent manner and in clear and understandable language:
(1) The name and contact method of the personal information processor.
(2) The purpose and method of processing facial information, and the storage period of the facial information processed.
(3) The necessity of processing facial information and the impact on personal rights and interests.
(4) The ways and procedures for individuals to exercise their rights according to the law.
(5) Other matters that shall be notified in accordance with laws and administrative regulations.
Where there is a change in the items specified in the preceding paragraph, the individual shall be informed of the change.
Where laws or administrative regulations provide that an individual is not required to be informed, such provisions shall prevail.
Processing the facial information of the disabled and the elderly shall also comply with the rules of the state on construction of a barrier-free environment.
Article 6 Where the facial information is processed with consent of an individual, the individual's separate consent granted in a voluntary and explicit manner shall be obtained under the premise of full knowledge. Where it is provided for in laws and administrative reg......