Face recognition in China: what the regulations say and where deployments are documented

This page is part of the face recognition section. It reads the texts as published on the issuing bodies' sites and records deployments only where an official document names them; it sits beside the page on face datasets and consent, which covers the research collections the same law reaches.

01What does the PIPL say about faces?

The PIPL, adopted by the Standing Committee of the National People's Congress on 20 August 2021, defines sensitive personal information in Article 28 as information whose leak or unlawful use could easily harm a person's dignity or safety, and lists biometric identifiers first among its examples. A processor may handle such information only with a specific purpose, sufficient necessity and strict protective measures, and Article 29 requires the individual's separate consent (NPC text). Article 26 addresses cameras directly: image collection and identity recognition equipment in public places must be necessary for public security, must carry a prominent notice, and the images and identity information collected may be used only for public security unless separate consent is obtained.

Three other provisions matter for face systems. Article 31 requires a parent's or guardian's consent for the data of children under fourteen. Article 55 requires a prior personal information protection impact assessment whenever sensitive information is processed, and Article 56 says the assessment report and processing records must be kept for at least three years. Article 62 instructs the national cyberspace authority to write dedicated rules for new technologies and applications, naming face recognition and artificial intelligence, which is the mandate the 2025 Measures cite.

02What did the Supreme People's Court interpretation add in 2021?

Judicial Interpretation No. 15 of 2021, adopted on 8 June 2021 and in force from 1 August 2021, tells civil courts how to treat disputes over face data under the Civil Code (Supreme People's Court Gazette). Article 2 lists conduct a court must treat as an infringement of personality rights, and its first item names the premises: using face recognition for verification, identification or analysis in hotels, shopping malls, banks, stations, airports, sports venues, entertainment venues and other business or public places in breach of law. Article 4 says a defence of consent fails where the processor made service conditional on face data that the service did not need, or bundled it with other permissions.

Article 10 documents one deployment pattern in particular. Where a property management company makes face recognition the only way for owners or occupants to enter a residential area, a court must support an owner who asks for another reasonable verification method. The interpretation does not say how many such systems existed; it records that the practice was common enough to need a rule.

03What do the 2025 Measures require?

The Security Management Measures for the Application of Facial Recognition Technology were adopted at the Cyberspace Administration's office meeting on 30 September 2024, issued jointly with the Ministry of Public Security on 13 March 2025, and took effect on 1 June 2025 (cac.gov.cn text). Article 2 limits their scope to processing face information with face recognition in China and excludes processing done for research and algorithm training. Article 19 defines the two tasks this site measures: verifying identity is a one-to-one comparison of a captured face with a stored one, the task scored as TAR at a fixed FAR on this site, and identifying a specific person is a one-to-many comparison against a stored set, the distinction between 1:1 and 1:N recognition that this site's metrics pages keep apart.

The operative articles, in the order the text gives them:

The filing threshold is the number most reported, and it moved between draft and final text. The draft published for comment on 8 August 2023 would have required filing once more than 10,000 people's faces were stored, or whenever the technology was used in a public place, with changes reported within 20 working days (2023 draft on cac.gov.cn). The final Measures raised the threshold tenfold to 100,000 and dropped the public-place trigger. A notice of 30 May 2025 set a deadline of 14 July 2025 for processors that already held 100,000 faces when the Measures took effect (filing notice).

04Where are deployments actually documented?

The official texts record use without counting it. The court interpretation names hotels, malls, banks, stations, airports, stadiums and entertainment venues as the places where unlawful use had reached the courts, and residential access control as a pattern worth its own article. The 2025 Measures assume devices in public places, prohibit them in four kinds of private space, and create a filing duty for operators above 100,000 stored faces; none of the texts fetched for this page publishes a count of filers, so none appears here. The Deep Synthesis Provisions of 2022, covered on the laws by jurisdiction page, regulate the generation side of the same technology from 10 January 2023.

One deployment-scale fact comes from outside China. NIST's 2019 demographic effects report (NISTIR 8280), which ran 189 mostly commercial algorithms over 18.27 million images, found false positive rates highest in West and East African and East Asian faces for most algorithms, and then noted that "with a number of algorithms developed in China this effect is reversed, with low false positive rates on East Asian faces" (NISTIR 8280). The report counts algorithms and images, not deployments; the demographic differentials page gives the full findings. Vendor counts, city-level camera totals and surveillance estimates circulate widely, but none of them comes with a primary document this page could cite, so none appears here.

05How do the rules compare with the regulators' decisions elsewhere?

The Chinese texts regulate the use of face recognition; the European and Australian decisions on this site punish the collection of training data. The ICO, CNIL and OAIC decisions against a web-scraping face search company, collected on this site's page of regulator rulings, concern a database built from public photographs without consent. The PIPL reaches the same conduct through Article 27, which allows processing of lawfully published information only within a reasonable scope and requires consent where the impact on the individual is significant, and through the 2025 Measures' exclusion of research and training from their scope, which leaves that activity under the general law rather than the dedicated rules.

For a reader checking a face video rather than a policy, the practical point is the one the checking a face video page makes: the legal status of a recognition system says nothing about whether the footage in front of you is real, and a filing with the cyberspace office is not an accuracy certificate.