CAC, MIIT and MPS launch 2026 personal information protection enforcement agenda targeting ads/SDKs/apps

A 京报网 reprint of the 网信中国 WeChat post carries the full text of 中央网信办、工业和信息化部、公安部关于开展2026年个人信息保护系列专项行动的公告, dated 2 April 2026. The original cac.gov.cn HTML for that announcement was not located in this pass; the reprint is used for the agenda wording, with later CAC confirmation on the official web site.

Seven campaigns named in the announcement

1. App and embedded SDK unlawful collection/use of personal information (missing rules, account deletion, complaint channels; incomplete or inconsistent notices; collection without consent / forced non-essential consent; over-collection and over-frequent permission calls).
2. Internet advertising intermediaries and media endpoints (over-collection; ads/profiling uses not disclosed; missing third-party sharing particulars; weak rights channels; automated advertising without an accessible personalisation off-switch, continued collection after opt-out, or missing label-deletion; weak internal controls).
3. Education-sector PI misuse.
4. Transport-sector PI misuse.
5. Health-sector PI misuse.
6. Financial-sector PI misuse.
7. Criminal crackdown on personal-information offences.

CAC progress note (19 Aug 2026)

The CAC page 2026年个人信息保护系列专项行动取得阶段性成效 confirms the same three-agency series and reports, among other figures, checks on 20,000+ App/SDK products, public naming of 1,100+ non-compliant App/SDK products, and advertising-rule checks at 1,000+ enterprises (figures as stated on that page; not independently re-counted here).

Operator table

Attribution, MMP, and ad-SDK inventories that touch Mainland China traffic sit inside campaigns 1 and 2. Treat personalisation off-switches and SDK disclosure tables as audit artefacts, not marketing copy.

Download the special-action card.

Research checked 20 September 2026. Local draft; human editorial review pending.