New Rules Issued for Online Identity Verification: Voluntary Use of Online IDs and Digital Certificates Clarified (AI Translation)

网络身份认证新规出台 明确自愿使用网号网证

The Chinese government has formally launched a new system for online identity numbers and credentials via the "Management Measures for National Online Identity Authentication Public Services" (“Measures”), set to take effect on July 15, 2024. This initiative, driven by a coalition of government agencies such as the Ministry of Public Security and the Cyberspace Administration of China, includes the official release of the “Digital Identity” app (formerly “National Online Identity Authentication”). The Measures seek to implement a unified issuance of digital "network IDs" and "network certificates" for the public and provide registration and verification services based on legal identity documents, with aims to enhance personal information security and foster the secure development of the digital economy [para. 1][para. 2][para. 3].

The Measures are the result of a year-long process, including a public comment period that drew over 17,000 suggestions from various stakeholders. This feedback primarily focused on ensuring the system’s voluntary nature, equal accessibility to internet services for all, strengthened data protections, and special safeguards for minors. The final version, which comprises 16 articles, addresses these concerns by clearly articulating the principle of voluntary participation, refining data security and privacy regulations, specifying platform construction and operation requirements, and emphasizing protections for vulnerable groups [para. 3][para. 4][para. 5][para. 6].

Structurally, the Measures clarify fundamental concepts such as "online identification number" (wanghao) and "online certificate" (wangzheng), describing the national public network identity authentication service as a state-operated system built upon legally recognized identity documents. The rules simplify the definitions compared to earlier drafts and highlight the legal basis for the service, referencing supporting statutes within the Cybersecurity Law, Personal Information Protection Law, and Anti-Telecom and Online Fraud Law. These laws collectively promote secure online identification and endorse the voluntary use of such digital credentials [para. 7][para. 8][para. 9][para. 10][para. 11].

Voluntary participation is central to the Measures. Individuals with valid identification can choose whether to apply for online IDs or certificates. The system is designed to give users an additional option for secure online registration, intended to reduce excessive collection of personal data by private platforms—a problem that has led to significant privacy breaches in the past. Nevertheless, experts caution that if the use of digital IDs becomes a de facto requirement across key industries, the spirit of voluntariness may be undermined, risking erosion of personal privacy and autonomy [para. 12][para. 13][para. 14][para. 15].

To address privacy concerns, the Measures restrict public service platforms to collecting only data strictly necessary for identity authentication and obligate them to inform individuals and obtain consent when personal data are processed. The guidelines also impose a "minimum necessity" principle in data collection and a "data minimization" principle in data sharing. This aims to lessen overcollection and reduce user exposure to privacy risks. However, legal scholars note that state-operated systems are not immune to data misuse and must be held to the same standards as private companies under Chinese law [para. 16][para. 17][para. 18][para. 19][para. 20].

The “Digital Identity” app, supporting these regulations, has received mixed user reviews. Some users praise its potential to curb identity theft, while others report issues such as technical difficulties and instances where use of the app is not optional. Some also express concerns that linking additional personal information remains necessary even when using digital credentials, potentially increasing risks of data leakage [para. 21][para. 22][para. 23][para. 24].

Finally, the app incorporates third-party plugins for technical functionalities such as facial recognition and risk monitoring. While this reduces development costs, it potentially expands the risk of data leaks due to broader involvement of external service providers, raising further questions about information security [para. 25][para. 26][para. 27].