China PIPL: separate consent is not a slogan
PIPL expects separate consent for sensitive personal information, public disclosure, and many cross-border transfers. Bundling is a liability.
China’s Personal Information Protection Law is among the world’s strictest on “separate consent.” Sensitive personal information, sharing with other processors, and overseas transfers often need a distinct, informed choice.
CAC rules around standard contracts and security assessments sit on top of that consent layer. A Western cookie banner is not a PIPL program.
Engineering the split
Model separate consent as first-class purposes in your manager. Do not infer PIPL consent from a GDPR accept-all. Keep China properties on a policy that legal has actually signed off.
Educational overview only — not legal advice. Confirm requirements with counsel for your products and markets.
