Following a year-long crackdown on privacy violations by apps and data companies featuring police raids, tens of thousands of arrests and hundreds of millions of yuan in frozen assets, Chinese authorities are setting out to define what actually constitutes inappropriate behavior.

The Cyberspace Administration of China (CAC), one of the country’s internet regulators, in a circular outlined examples Monday of bad behavior including data collection without consent, without clear purpose and unrelated to services provided, as well as inappropriate use or transfer of personal data.

The CAC did not state the penalties for such behaviors.

China’s efforts to combat privacy violations have ranged from piecemeal legislation to full-scale police operations. Between January and October, the country’s “Internet Cleanup 2019” led to the investigation of almost 46,000 cases of internet crimes, the arrest of nearly 66,000 suspects and the breakup of criminal gangs, many of which were involved with fintech and big data companies that used personal data obtained illicitly to enable predatory lending and shady debt collection.

According to the CAC’s new list of transgressions, valid reasons for data collection no longer include improving service quality or user experience, targeting of messages, and research and development of new products. This suggests developers will need to go to greater lengths to justify app behavior. The text further limits apps’ message targeting capabilities by requiring the ability for users to opt out of personalized algorithms.

The agency’s circular suggests that apps will be required to have prominent, easy-to-understand privacy policies that are not overly long or laden with jargon. It also designates the types and frequency of data collection that are unnecessary to services provided, based on research conducted by the China Academy of Information and Communications Technology. The study found, for example, that some apps continued to report on a user’s location even after they were closed.

The CAC defined “providing personal data to third parties without user consent” as doing so without making the data anonymous, not just without permission. Echoing a September draft revision to laws protecting minors that added cyberspace provisions, the list of infractions also targets companies that obstruct users from editing or deleting data and accounts or don’t provide a channel for complaints.

Contact reporter Dave Yin (davidyin@caixin.com)

Related: Finance Apps Come Under Closer Scrutiny From China Regulators