In January 2015, State Administration for Industry and Commerce (SAIC) published the Measures for the Punishment of Conduct Infringing the Rights and Interests of Consumers (the Measures), effective from 15 March 2015.

The Measures require that business operators who collect or use consumers’ personal information shall “clearly state the purpose, manner, and scope for the collection and use and obtain consumers’ consent.”

Business operators are explicitly prohibited from:

• collecting and using consumers’ personal information without consent;
• leaking, selling or illegally providing consumers’ personal information to others; and
• sending commercial information to a consumer without consent or request from the consumer, or after objection from the consumer.