A
Don't have the platform collect the money itself and then pass it on to sellers; let the money settle directly through a licensed payment institution
Value for cost High
In plain termsIf the buyer's money first goes into your account and you then transfer it to the seller, you are doing payment business. Doing this business requires approval from the People's Bank of China, and you also have to actually put up one hundred million yuan of capital. Do it without approval and you will be shut down, the money you made will be taken away, and you will be fined, with the boss and the person who handled it fined separately. In serious cases you will also be sentenced. There is only one safe approach: the money does not enter your account.
- Cost
- Costs nothing. It takes a little time to integrate a product from a licensed payment institution. A licensed payment institution is a company that has obtained a payment license from the central bank. Use its split-settlement or guaranteed-transaction function, so the buyer's money is settled directly to the seller and never enters the platform's own account
No money
A few hours
No willpower
Benefit size large
- Benefit
- The payment business the regulations refer to is “transferring monetary funds according to electronic payment instructions submitted by the payee or the payer.” Put plainly, it means moving money for others on their instructions. To do this business, one “shall be approved by the People's Bank of China and obtain a payment business license.” The minimum registered capital is 100 million yuan, and it must be paid-in monetary capital: this 100 million yuan has to be real money paid into the company's account. “Where a non-bank payment institution is established without lawful approval, or payment business is engaged in, or engaged in in disguised form, the People's Bank of China shall ban it according to law and confiscate the illegal gains.” Anyone who does this without approval is shut down outright and has the money they made taken away. If the illegal gains are 500,000 yuan or more, there is an additional fine of 1 to 5 times the illegal gains. If there are no illegal gains, or they are under 500,000 yuan, the fine is 500,000 to 2 million yuan. The legal representative and the persons directly responsible are fined separately, 100,000 to 500,000 yuan. The Criminal Law (刑法) also counts “illegally engaging in fund payment and settlement business” as illegal business operation (非法经营). Where the circumstances are serious, the sentence is up to 5 years; where they are especially serious, 5 years or more. What counts as “serious circumstances” is drawn in an interpretation by the Supreme People's Court and the Supreme People's Procuratorate. The line is an illegal business volume of 5 million yuan or more, or illegal gains of 100,000 yuan or more (nationwide, from May 2024)
- Evidence grade
- A
- Notes
- Designing things so the money never enters your account is the only safe approach. In the market this kind of collecting and paying on others' behalf is called “second clearing” (二清), but the term does not appear in official documents. The implementing rules (实施细则) use the phrase “engaging in payment business in disguised form,” meaning moving money for others on users' instructions without approval. That interpretation by the Supreme People's Court and the Supreme People's Procuratorate lists only three situations: cashing out through fabricated transactions, cashing out through an entity's account, and cashing out through checks. It does not name platforms collecting and paying on others' behalf, so you cannot say that a platform collecting and paying on others' behalf “definitely constitutes a crime”
A
Most websites that charge users need a license; one that sells its own goods and doesn't let others set up shop does not; brokering transactions takes a different kind of license; a free site only needs a filing
Value for cost Standard
In plain termsMost websites that charge users have to obtain the value-added telecommunications business operating license first, and an individual cannot get this license. If you only sell goods on your own website or app and don't let others set up shop there, you don't need it. If you only run a WeChat or Alipay mini program or an online store, you don't need it either. If you should have it but start charging and running the site without it, your income will be confiscated and you will be fined, and in serious cases the site will be shut down.
- Cost
- Filing costs nothing. The value-added telecommunications business operating license (增值电信业务经营许可证) costs money; it governs “whether a website that charges users may open.” To apply for this license you first need a company. To operate only within one province, registered capital must be no less than 1 million yuan. To operate across provinces, no less than 10 million yuan. The review period is 60 days, and the license is valid for 5 years
Real money
Time every day
No willpower
Benefit size large
- Benefit
- The regulation's own words are: “The state applies a licensing system to commercial internet information services, and a filing system to non-commercial internet information services. Without obtaining a license or completing filing procedures, no one may engage in internet information services.” A site that charges money must get a license first, one that doesn't must file first, and with neither you cannot open a site. What counts as commercial? The regulation says it is “service activities of providing information, web page production or other services to internet users for a fee through the internet.” Simply put, it means charging users. The kind that brokers transactions is called online data processing and transaction processing business, known in the industry as EDI. The regulation defines it as “business that uses various data and transaction/affairs processing application platforms connected to the public communication network or the internet to provide users with online data processing and transaction/affairs processing through the public communication network or the internet.” It also “includes transaction processing business, electronic data interchange business, and network/electronic device data processing business.” What this describes is a website processing data online for users, or brokering and processing transactions for buyers and sellers. Operating without a license, or operating beyond scope, both bring confiscation of the illegal gains plus a fine of 3 to 5 times the illegal gains. Operating beyond scope means you have a license but do things beyond the scope written on it. If there are no illegal gains, or the illegal gains are under 50,000 yuan, the fine is 100,000 to 1 million yuan. Where the circumstances are serious, the website is ordered closed (nationwide). Charging money does not necessarily mean you must get this license. A Q&A issued by the Guangdong Communications Administration in October 2025 says that, per the requirements of the Ministry of Industry and Information Technology (MIIT), the following three situations do not need this license. First, an enterprise on its own website or app “sells its own or other enterprises' goods or services directly on a self-operated basis,” and no other entity or individual has set up shop on it. Second, an enterprise only publishes its own information on its own website or app and does not provide a platform for others to publish information. Third, an enterprise does business only through mini programs, official accounts, Channels accounts or online stores on platforms such as WeChat and Alipay, “and has no other independently operated platform.” Conversely, as soon as you let others set up shop, or let users publish information on your site, you are not in these three situations
- Evidence grade
- A
- Notes
- To tell whether what you plan to do falls into the EDI category, match it yourself against the definition in the Telecommunications Business Classification Catalogue (电信业务分类目录). No official text says in so many words that “an e-commerce platform with brokering and fund processing must get an EDI license.” MIIT's service guide only says to “apply for the corresponding telecommunications business operating license according to how the business is defined.” So whether you need it can only be judged by yourself against the definitions. One more point: an individual cannot get this license; the applicant must be a lawfully established company. The three situations in which self-operation needs no license come from the Guangdong Communications Administration's Q&A, which states that it follows MIIT's requirements, but no identical public text was found from other provinces. If you are unsure, first call your local communications administration. The Q&A also reminds you that you don't need an intermediary to get the license: materials are submitted only on MIIT's “Telecommunications Business Market Integrated Management Information System,” and no official fee is charged
A
Live streaming needs an Internet Culture Business License; the license for audiovisual programs is basically out of reach for private companies
Value for cost Standard
In plain termsLive streaming and game commentary require an Internet Culture Business License issued by the provincial-level culture department. The business scope on the license must state online performance explicitly. A result comes within 20 days of acceptance, and the license lasts 3 years. You must keep the videos you have broadcast yourself for a full 60 days. Open for business without the license and you will be ordered to stop and given a warning, plus a fine of up to 30,000 yuan; if you don't stop, you go on a blacklist.
- Cost
- The Internet Culture Business License (网络文化经营许可证), commonly called the wangwen license (网文证), governs “whether you can make money from online performances such as live streaming and game commentary.” It is approved by the provincial-level cultural administrative department, with a result within 20 days of acceptance, and is valid for 3 years; renew it 30 days before it expires. The audiovisual program license governs “whether you can put programs online,” and it requires the applicant to be a wholly state-owned or state-controlled entity
Real money
Time every day
No willpower
Benefit size large
- Benefit
- Entities doing online performance must get the license first. The regulation's own words: they “shall, in accordance with the Interim Provisions on the Administration of Internet Culture (互联网文化管理暂行规定), apply to the provincial-level cultural administrative department for an Internet Culture Business License, and the business scope of the license shall explicitly include online performance.” Playing games for others to watch, or commentating on them, is governed by the same set of rules; the regulation's words are “managed with reference to these Measures.” All video materials of online performances shall be “kept for no less than 60 days”: you must keep the videos you have broadcast yourself for a full 60 days. Those who carry out commercial internet cultural activities without approval are ordered to stop, given a warning, and fined up to 30,000 yuan. Those who still do not stop after being told are placed on the cultural market blacklist. Putting programs online needs a different license: one “shall obtain an Audio-Visual Program Online Transmission License (信息网络传播视听节目许可证).” The applicant must “have legal person status and be a wholly state-owned or state-controlled entity,” meaning it must be an entity wholly owned or controlled by the state; private companies basically can't get it. Doing this without the license brings a warning and an order to correct, and an additional fine of up to 30,000 yuan may be imposed. Where the circumstances are serious, penalties follow the Regulations on Radio and Television Administration (广播电视管理条例) (nationwide)
- Evidence grade
- A
- Notes
- Which kind of business goes with which license is stated most clearly in the seven-department document. A platform making money from live streaming needs the wangwen license plus an ICP filing; the ICP filing is the procedure of registering a website with MIIT. One that puts programs online needs the audiovisual license, or must complete registration. One that publishes news needs an Internet News Information Service License (互联网新闻信息服务许可证). Also, the Interim Provisions on the Administration of Internet Culture (互联网文化管理暂行规定) reposted on the Chinese government website in 2025 is the unamended 2011 original; when citing it, go by the current text from the Ministry of Culture and Tourism
A
A server inside China needs a filing, and the access provider must itself hold a value-added telecommunications license
Value for cost Standard
In plain termsIf the server is inside China, you must file before opening the site. Filing costs nothing; it is submitted together with the server at the service provider and generally takes a few days to a few weeks. Without a filing you are ordered to correct within a time limit and fined 10,000 yuan, and if you don't correct, the site is shut down. If your home page does not display the filing number, there is a separate fine of 5000 to 50,000 yuan.
- Cost
- Filing costs nothing. It is submitted together with the server at the service provider, and usually takes a few days to a few weeks. Ten minutes is enough to check once whether the service provider has the required qualifications
No money
A few hours
No willpower
Benefit size medium
- Benefit
- The regulation's own words: “Without filing, no one may engage in non-commercial internet information services within the territory of the People's Republic of China.” Even a website that does not charge users must file first, as long as it is located inside China. Without a filing, you are ordered to correct within a time limit and fined 10,000 yuan. If you refuse to correct, the website is closed. The service provider that connects your server to the internet is also regulated: it “shall not provide internet access services to organizations or individuals engaging in non-commercial internet information services without filing.” The same goes for service providers that collect money for you. The regulations say such providers “shall not provide access, fee collection or other services to entities or individuals that have not lawfully obtained an operating license or completed the filing procedures for non-commercial internet information services.” This means a legitimate provider is not allowed to connect a site that has neither a license nor a filing. Further, data-center colocation and cloud hosts are called internet data center business in the regulations, and broadband access is called internet access service business; both of these require a license in themselves, so the service provider must first hold one. A website whose home page does not display its filing number is ordered to correct and fined 5000 to 50,000 yuan (nationwide)
- Evidence grade
- A
- Notes
- Before negotiating price, first check whether the service provider has a license. To check licenses, use MIIT's Telecommunications Business Market Integrated Management Information System at tsm.miit.gov.cn, searching by the company's full name or the license number. To check website filings, use beian.miit.gov.cn. With a “data center” that lacks the corresponding license, on the day something goes wrong you won't even know whom to complain to. Putting the machine outside China does let you get around the filing. But if your users are inside China and the money is inside China, not one of the obligations in Items 5 to 10 of this section goes away, and there is an extra layer of data-export costs
A
If you let users sell on your platform, the platform must verify and register them, report information, and keep records for three years
Value for cost Standard
In plain termsIf you let others sell on your platform, you must first verify the seller's identity, address, contact details and licenses, then register them and set up a file. Once the file is set up, go back and verify again at least every six months. Who the sellers are must be reported to market regulation, and their tax situation reported to the tax authorities every quarter. Keep product and transaction records for three years. Miss any one of these and you are first ordered to correct; if you don't, the fine is 20,000 to 100,000 yuan.
- Cost
- Costs nothing. You need to build seller qualification checks into the back end, and set up a registration file as well. Report tax-related information once a quarter, and keep transaction data for three years. The hard part is that this is year-round work, not something done once and finished
No money
Time every day
Some willpower
Benefit size large
- Benefit
- The law has a passage of requirements for platforms. Its own words: platforms “shall require operators applying to enter the platform to sell goods or provide services to submit true information such as their identity, address, contact details and administrative licenses, verify and register it, establish registration files, and regularly verify and update them.” Before a seller comes on, they must submit their identity, address, contact details and whatever licenses they are required to hold. You check it once, register it and set up a file, and after that go back and check again every so often. How often is “regularly”? A departmental rule is more specific: “verify and update at least once every six months.” You must also report the identity information of operators on the platform to the market regulation authorities. The tax side must be reported to as well; the wording is “report to the tax authorities the identity information of operators on the platform and information related to tax payment, in accordance with the laws and administrative regulations on tax collection and administration.” So who the sellers are goes to market regulation, and the sellers' identities and tax situation go to the tax authorities. Goods and service information and transaction information “shall be kept for no less than three years from the date the transaction is completed”: counting from the day a transaction is completed, the data must be kept for at least three years. Failure to do any one of the above brings an order to correct within a time limit. If it is not corrected by the deadline, the fine is 20,000 to 100,000 yuan. Where the circumstances are serious, you are ordered to suspend business for rectification and fined 100,000 to 500,000 yuan. Tax-related information must be reported “within the month following the end of the quarter”: within the month after each quarter ends. Failure to report on time carries the same penalties (nationwide)
- Evidence grade
- A
- Notes
- Sellers must also register as market entities themselves. The law lists some cases that need not: “individuals selling self-produced agricultural and sideline products or household handicraft products, individuals using their own skills to engage in convenience labor services that lawfully require no license, and sporadic small-value transactions.” “Sporadic small-value” has a specific figure: Article 8 of the Measures for the Supervision and Administration of Online Transactions (网络交易监督管理办法) sets it at an annual transaction volume of 100,000 yuan. The platform also has two more things to do: mark registered and unregistered sellers separately, and not delete consumers' reviews
A
You must manage what users post: a review mechanism, a reporting channel, and when you find something illegal, stop its transmission immediately and report it
Value for cost Standard
In plain termsWhen something users post causes trouble, the platform is responsible. You must set up the whole system: registration, review of posts, review of comments, daily patrols, and how to handle incidents. Put a reporting channel in a prominent place on the page. When you see illegal information, immediately stop it from spreading, keep records, and report it to the competent authority. If you don't, the fine is 50,000 to 500,000 yuan, and more in serious cases.
- Cost
- It costs money to hire people to review content; this is a platform's biggest long-term expense. The reporting channel and the record of every action taken must leave a trail. The hard part is that someone has to watch it every day; stop for one day and something may go wrong
A little money
Time every day
Lots of willpower
Benefit size large
- Benefit
- The regulations say platforms “shall fulfill their primary responsibility for information content management”: the platform itself is responsible for managing what users post. Specifically, they must “improve systems for user registration, account management, review of information publication, review of follow-up posts and comments, ecological management of sections and pages, real-time patrols, emergency handling, and handling of online rumors and black-market industry chain information.” From registration, posts and comments to daily patrols and incident handling, every link needs written rules. They also “shall set up a convenient complaint and reporting channel in a prominent position”: the report button must be where users can see it at a glance and reach it with a click. On discovering illegal information, they “shall immediately take handling measures according to law, keep relevant records, and report to the relevant competent authorities.” The Cybersecurity Law (网络安全法) is more specific. Its own words: “On discovering information that laws or administrative regulations prohibit from being published or transmitted, it shall immediately stop transmitting that information, take handling measures such as deletion, prevent the information from spreading, keep relevant records, and report to the relevant competent authorities.” Failure to do so brings an order to correct, a warning and a circulated notice, and an additional fine of 50,000 to 500,000 yuan may be imposed. For refusing to correct, or where the circumstances are serious, the fine is 500,000 to 2 million yuan, and you may also be ordered to suspend business for rectification, have the website or app closed, or have your license or business license revoked. Persons directly responsible are fined separately, 50,000 to 200,000 yuan (nationwide)
- Evidence grade
- A
- Notes
- You don't have to invent review rules; just copy them. Which nine categories of content may not be posted is listed plainly in Article 15 of the Measures for the Administration of Internet Information Services (互联网信息服务管理办法). Live streaming adds three more things: you must “establish a live-stream content review platform”; you must be able to cut off a live stream in progress at any time, which the regulation calls “immediate blocking”; and you must keep live-stream content and logs for 60 days. Video materials of online performances are likewise kept for no less than 60 days
A
If you provide information publishing or instant messaging services, you must require users to provide their real identity information
Value for cost Standard
In plain termsIf your website lets people post or chat, you must ask for the user's real identity information when they open the service. If they don't give it, you can't let them use it. The way to do it: store the real name in the back end, let the user decide what nickname shows on the page, and a mobile number is enough for verification. If you don't implement real names, you are first ordered to correct. If you don't, the fine is 50,000 to 500,000 yuan, and the site may be shut down.
- Cost
- You need to integrate a real-name verification channel, and such channels charge per check. Design the product on the principle of “real name in the back end, voluntary on the front end”: store real names in the back end, and show nicknames on the page
A little money
A few hours
No willpower
Benefit size medium
- Benefit
- The law's own words: “When network operators handle network access or domain name registration services for users, handle network access procedures for fixed-line or mobile telephones, or provide users with services such as information publishing or instant messaging, they shall require users to provide real identity information when signing agreements with users or confirming the provision of services. Where a user does not provide real identity information, the network operator shall not provide the relevant services to that user.” If you did not require real identities, or a user gave no real identity and you let them use the service anyway, you are ordered to correct. For refusing to correct, or where the circumstances are serious, the fine is 50,000 to 500,000 yuan, and you may also be ordered to suspend the relevant business, suspend business for rectification, close the website or app, or have your license or business license revoked. Persons directly responsible are fined separately, 10,000 to 100,000 yuan. Live-streaming services follow the principle of “real name in the back end, voluntary on the front end,” and carry out “real identity information authentication based on mobile phone numbers and similar methods.” This means the platform keeps the user's real name in the back end, the user decides what nickname shows on the page, and verification relies on something like a mobile number. Live-stream selling has stricter requirements: “real identity information authentication based on identity document information, unified social credit codes and other real identity information.” The unified social credit code is the string of characters on a business license (nationwide)
- Evidence grade
- A
- Notes
- The article numbers have moved. The Cybersecurity Law (网络安全法) was amended in 2025, effective January 1, 2026. This real-name provision moved from Article 24 to Article 26, and its penalty provision from Article 61 to Article 64. The wording of the provisions did not change. If the materials you have still cite the old article numbers, update them
A
Don't open live-streaming accounts for anyone under 16; handle tipping in tiers by age
Value for cost Standard
In plain termsPeople under 16 may not register a streaming account on your platform. For those who have turned 16, verify their identity and also get the consent of their parents or other guardians. Tipping has three tiers: under 8, no tipping; 8 to 16, guardian consent required; 16 and over, guardian consent or verification of proof of income required. If a child tips behind the guardian's back and the guardian asks for the money back, the court will order it returned.
- Cost
- Costs nothing. Add a step at each of two points, registration and payment: first determine the age, then confirm that the guardian has consented
No money
A few hours
No willpower
Benefit size medium
- Benefit
- The law's own words: “Live-streaming service providers shall not provide live-stream publisher account registration services to minors under the age of sixteen; when providing live-stream publisher account registration services to minors who have reached the age of sixteen, they shall authenticate their identity information and obtain the consent of their parents or other guardians.” The regulation also requires “establishing a dynamic verification mechanism for the real identity information of live-stream publishers”: you must be able to re-check the identity of whoever is streaming at any time. In addition, you must “reasonably limit the single-transaction amount and the single-day cumulative spending amount of minors of different age groups in using the services”: set per-transaction and per-day spending caps for minors by age. Tipping now has three tiers: “Tipping services shall not be provided to minors aged eight or under. Providing tipping services to minors aged eight to sixteen requires the consent of their guardian. Providing tipping services to minors aged sixteen or over requires the consent of their guardian or verification of their proof-of-income materials.” One more rule: if a person with limited civil capacity tips without the guardian's consent and the guardian asks for the money back, the court should support the claim, and the money can be recovered. A person with limited civil capacity means a minor who legally cannot yet fully make their own decisions (nationwide)
- Evidence grade
- A
- Notes
- If a refund dispute really does arise, handle it in the way most favorable to the minor. The position on this has changed. The 2022 opinions from four departments and the 2020 notice from the National Radio and Television Administration both said that minors may not tip at all. The new notice of April 2026 changed this to tiers at age 8 and age 16, but did not state that the two earlier documents are void, and officials have not said how the two fit together. So the statement “minors are completely banned from tipping” is now inaccurate
A
Act promptly on infringement notices; if nothing follows within 15 days after forwarding the declaration, restore what was removed
Value for cost Standard
In plain termsIf someone sends an infringement notice with preliminary evidence attached, you must promptly take the item down, block it or disconnect the link, and at the same time forward the notice to the seller. If you drag your feet, you have to pay for the additional loss together with the seller. If the seller responds, forward the response to the other party and wait 15 days. If the other party has neither filed a complaint nor sued, restore the item.
- Cost
- Costs nothing. Build a fixed process: receive the notice, forward it to the seller, collect the seller's response, and publish the result. Keep a record of every step
No money
A few hours
No willpower
Benefit size medium
- Benefit
- The rights holder “has the right to notify the e-commerce platform operator to take necessary measures such as deletion, blocking, disconnecting links, and terminating transactions and services. The notice shall include preliminary evidence of infringement.” The rights holder is the owner of rights such as trademarks, copyrights and patents. A bare statement doesn't count; preliminary evidence must be attached. After receiving the notice, the platform “shall promptly take necessary measures and forward the notice to the operator on the platform; if it fails to take necessary measures in time, it bears joint and several liability with the operator on the platform for the expanded part of the damage.” If you put off dealing with it, you have to pay for the additional loss together with the seller. After the seller responds, the platform, “if it has not received notice that the rights holder has filed a complaint or sued within fifteen days after the forwarded declaration reaches the intellectual property rights holder, shall promptly terminate the measures taken.” This means: forward the seller's response to the rights holder and wait 15 days. If the other party has neither complained nor sued, restore what was deleted or taken down. A platform that knows or should know of infringement and does not deal with it bears joint and several liability with the infringer. The intellectual property authorities can also order you to correct within a time limit; if you don't correct by the deadline, the fine is 50,000 to 500,000 yuan, and 500,000 to 2 million yuan where the circumstances are serious. Conversely, “anyone who maliciously sends an erroneous notice, causing losses to the operator on the platform, shall bear double compensation liability” (nationwide)
- Evidence grade
- A
- Notes
- If you are not an e-commerce platform, just an ordinary website, follow the notice-and-takedown rules of the Civil Code (民法典). The difference is how long you must wait after the other side responds: the E-Commerce Law (电子商务法) gives a clear 15 days, while the Civil Code only says “a reasonable period.” Also, publishing the notices you receive, the sellers' responses and your handling results is an express requirement of Article 44 of the E-Commerce Law. If a platform itself organizes uploads of pirated content, or knowingly leaves infringement in place, the rule “take it down once notified” cannot protect it; see Section 9, Item 24 (fan-translated comics, reposted films and TV series)
A
Don't casually move user information outside China; exporting it has legal conditions and headcount thresholds
Value for cost Standard
In plain termsTransferring the information of users inside China to machines outside China is what is called export. Putting the server outside China does not mean the data has not been exported. To export, you have to take one of four routes: a security assessment by the cyberspace administration, certification by a professional institution, signing a contract under the standard contract, or other conditions provided by law. You must also tell users who the overseas recipient is and what it will use the information for, and ask them once specifically about this.
- Cost
- Costs nothing. The easiest approach is to keep user data inside China. If you really need to transfer it outside China, use the standard contract or get certification
No money
A few hours
No willpower
Benefit size medium
- Benefit
- Giving the information of users inside China to a company outside China, or storing it on machines outside China, is legally called providing personal information outside the country, and one “shall meet” one of four conditions. One, pass a security assessment organized by the cyberspace administration. Two, have a professional institution carry out personal information protection certification. Three, sign a contract with the overseas recipient under the standard contract formulated by the cyberspace administration. Four, other conditions provided by laws and administrative regulations. At the same time you must tell users the following: the overseas recipient's name and contact details, the purpose and method of processing, the categories of personal information, and how they can exercise their rights. And you must “obtain the individual's separate consent”: ask the user once specifically about this. The specific thresholds are tiered by the cumulative number of people. Ordinary enterprises are called, in the regulations, data processors other than critical information infrastructure operators. Such enterprises have an exemption line; the wording is “cumulatively providing personal information (excluding sensitive personal information) of fewer than 100,000 people outside the country since January 1 of the current year.” Below this line, filing for a security assessment, concluding a standard contract and obtaining certification are all exempted. For 100,000 or more but fewer than 1 million people, you shall conclude a standard contract or pass certification. For 1 million or more people, or sensitive personal information of 10,000 or more people, you shall file for a security assessment (nationwide, from March 2024)
- Evidence grade
- A
- Notes
- Putting the server outside China does not mean “the data has not been exported.” If a user registers inside China and you transfer their information to a machine outside China, that is export. One category does not need to go through any of the three routes of security assessment, certification and standard contract: cross-border shopping, cross-border delivery, and booking flights and hotels, which are transfers genuinely necessary “to conclude or perform a contract to which the individual is a party.” Also note how the headcount is counted: “cumulatively since January 1 of the current year,” not twelve months back from today
C
When choosing a server, first ask whether you can tolerate downtime, then whether you have someone to run it, and only last compare prices
Value for cost Standard
In plain termsThe difference between the three tiers is not price; it is what you have in hand on the day something goes wrong. Big providers have a filing channel and public qualifications; when things break there are announcements and compensation clauses, and you can reach a person. Small providers are half the price, but when they oversell, vanish, or get cut off by their upstream, you won't even know whom to turn to. For a static site with no user data, a VPS for a few tens of yuan is enough.
- Cost
- Cloud hosts from mainstream cloud providers cost several hundred to several thousand yuan a month. VPSs from small providers start from a few tens of yuan a month. A VPS is a small virtual server. Dedicated server colocation starts from several thousand yuan a year, and you have to buy the hardware yourself
A little money
A few hours
No willpower
Benefit size medium
- Benefit
- The difference between the three tiers is not price; it is what you have in hand on the day something goes wrong. Mainstream cloud providers have a filing channel, their qualifications are public, they post announcements about outages, the contract has compensation clauses, and when there is a problem you can reach a person. Small providers can be half the price, but when they oversell, vanish, or get cut off by their upstream, you have no one to appeal to, so before negotiating price, first check in the MIIT system whether they hold a value-added telecommunications business operating license. Dedicated server colocation pays off only when both conditions hold: bandwidth or hardware costs are clearly cheaper, and you have your own people to do operations. How to choose: for a static site with no user data, the cheapest VPS is enough. For a site with user registration and transactions, choose cloud hosts that can scale elastically and take snapshot backups, and keep backups in at least two places
- Evidence grade
- C
- Notes
- The above is experience-based judgment, with no evidence from the literature. The only thing you can truly verify is the service provider's license. If you want to save money, save on configuration and bandwidth, not on qualifications
- Sources
- 作者经验，无直接文献；服务商资质与备案的法定要求见本节第 4 条，日志留存 6 个月和等级保护义务见第 11 节第 16 条
