No, cookie information is considered personal information, and personal information must be processed on a recognised legal ground.
Consent is usually required for placing a cookie to collect information.
The rules are not universally followed, and implementation is patchy so far. The reason is that the Personal Information Protection Law (PIPL), the first mandatory data protection law in China, took effect on 1 November 2021 after being published mid-2021 and there has been little active enforcement related to cookies so far. We expect that the rules will be more widely followed and enforced now the PIPL has come into force.
Yes, but only if the party processing personal information via cookies can rely on another legal ground. For example, it is necessary for concluding or performing a contract to which the individual is a party or for performing statutory obligations or duties.
Consent is required for placing a cookie unless the data processing party can rely on a different legal ground. Therefore, the cookies cannot be placed automatically.
Further, if the cookies collect sensitive personal information, a separate consent is required.
Under PIPL, consent needs to be, among other things, unambiguous. Although the law does not further elaborate on the requirement of unambiguity, an implied consent may not satisfy the requirement.
A standalone cookie policy is not necessary, although it is considered good practice. However, if an individual refuses to give consent, you cannot refuse to provide the services or product on that basis unless cookie information is strictly necessary for such services or products.
It is not mandatory, although this will be considered good practice.
No. A cookie wall will not give individuals the right to reject data processing and the consent may be invalidated as it may be considered not “freely given”.
Besides, the PIPL expressly prohibits entities from refusing to provide products or services if the individuals refuse to give or withdraw their consent, unless it is necessary to provide the service. Therefore, you are not able to use cookie walls.
We have seen very few cases on cookie rules after the PIPL took effect but expect to see more enforcement and court cases in the future.
None that we are aware of.
Early court decisions tend to exclude cookie information from personal information or privacy rules. However, under the Civil Code and PIPL, the current consensus is that cookie information will be considered personal information.
The cookie rules remain to be tested in enforcement and judicial cases.
