T/TAF 267.1-2025: advertising SDK personal-info protection requirements (10 Feb 2025)

The Telecommunications Terminal Industry Association (电信终端产业协会, TAF) PDF T/TAF 267.1—2025, opened on 20 September 2026, is titled Technical requirements for user rights and personal information protection of Software Development Kits (SDK)—Part 1: Advertising category. The cover states 发布 / 实施 2025-02-10. Drafters listed include China Academy of Information and Communications Technology (中国信息通信研究院), 北京巨量引擎网络技术有限公司 (Ocean Engine), 北京火山引擎科技有限公司, and several OEMs.

Scope on the page

Clause 1 applies the file to advertising SDK developers/operators and to supervisors or third-party assessors. Clause 3.3 defines “advertising activities” to include request, display, monitoring, attribution, anti-fraud, and delivery analysis/optimisation. Collection rules in 5.1 require, among other points, that where the SDK user relies on end-user consent, the ad SDK operator must prompt the SDK user not to use the SDK to obtain personal information before that consent; that personal information is obtained in scenarios where the SDK user elects to call the ad SDK; and that aggregation SDKs collect only what is necessary for aggregation and default-configure third-party SDK collection within a controllable scope.

Storage (5.2), use/processing including personalised ads with consent (5.3), encrypted transmission preferably HTTPS for monitoring data (5.4), and contractual minimum-necessary sharing with advertisers/DSP/MMP-style parties (5.5) are spelled out. User-rights clause 6 ties personalised-ad disclosures and end-user rights handling to contracts/rules with the SDK user, and references T/TAF 078.7—2023 against deceptive forced downloads.

What this standard is not

This is a TAF group standard, not a CAC administrative penalty decision, not an App Store policy, and not a measurement of OAID/IDFA fill rates in live campaigns. Compliance with T/TAF 267.1 does not by itself prove a specific SDK build is lawful under PIPL for a named game.

Operator action

Download the standard card. Pair with the push-SDK sibling T/TAF 267.2 when reviewing re-engagement stacks.

Research checked 20 September 2026. Local draft; human editorial review pending.