PIPL: SDK inventory a UA stack must list
Operator checklist derived from the 2 April 2026 CAC–MIIT–MPS App/SDK and internet-advertising campaigns: every UA-relevant SDK must be inventory-listed with purpose, data types, and disclosure status before a Mainland China flight.
The 2 April 2026 joint announcement (网信中国 text) puts common apps and embedded SDKs and internet advertising at the front of the 2026 PI protection series. CAC’s 19 August 2026 progress note confirms large-scale App/SDK and advertising checks under that series.
Inventory columns a UA stack should fill
For each SDK that can run on a Mainland China build (MMP, ad network, analytics, crash, push, social login, payment):
- Legal name / developer of the SDK vendor.
- Purpose in product language that matches the privacy notice (attribution, ads, fraud, crash, etc.).
- Personal-information types potentially collected (device identifiers including OAID, rough location, app list, etc.).
- Whether collection is disclosed in the in-app rules and whether purpose/method/scope match actual behaviour (campaign 1 failure modes).
- Third-party sharing particulars if ad or analytics data leaves the handler (campaign 2 failure modes).
- Personalisation off-switch path if the SDK supports profiling/ads (campaign 2).
- Account deletion / complaint channel ownership (app vs SDK).
- Owner sign-off date before the next China build freeze.
Explicit limits
This checklist is an operator map from the 2026 special-action wording. It is not a substitute for counsel’s PIPL Article-by-Article memo and does not invent statutory fine amounts per SDK.
