China’s New Personal Information Protection Law Forced Out Yahoo and Linkedin: Will YOU Be Next

Home | China Law Blog | China’s New Personal Information Protection Law Forced Out Yahoo and Linkedin: Will YOU Be Next Table of Contents Toggle 1. China's Data Protection History China's long anticipated (and dreaded) Personal Information Protection Law (PIPL) is now a reality. Way back in 2018 we wrote about personal information protection legislation in China when the country’s Standardization Administration, authorized by the State Council, issued a document, GB/T 35273-2017 Information Technology – Personal Information Security Specification (信息安全技术 个人信息安全规范) (the “Specification”). That personal information protection Specification was not a law or regulation that required mandatory compliance, but it paved the way for the Personal Information Protection Law (PIPL), which came into effect on November 1, 2021. The PIPL delineates the rights of individuals to access and control personal data held by companies and restricts what companies can do with data. The Chinese-language text of the PIPL is here and an unofficial English translation is here. 2. The Impact of China's Personal Information Protection Law On the day the PIPL came into effect, Yahoo! announced it would cease operating in China. Yahoo said it was leaving China because of its “increasingly challenging business and legal environment”. In October, Microsoft-owned LinkedIn announced that LinkedIn would be shutting down in China due to China's “significantly more challenging operating environment and greater compliance requirements.” 3. China's Personal Information Protection Law Compared to California's Consumer Privacy Act and the EU's GDPR In 2019, we warned that Chinese authorities were in the process of building on the Specification to enact PIPL. In this same post, We also highlighted the similarities and differences between Chinese data privacy laws and the General Data Protection Regulation (“GDPR”), the EU's data privacy laws. We also noted that California has important data privacy legislation, the California Consumer Privacy Act (“CCPA”). We also highlighted an important difference between the China, the EU and California's data privacy laws: U.S. or E.U. companies doing business in China will not be able to rely on having entered into contracts with Chinese citizens to process their data. they will now need to painstakingly explain all of the ways in which they will use the data and get consent for using it, unless one of the other few very narrow exceptions applies. If you want to change how you process data after collecting it and getting consent, most of the time that will be just too bad—unless there’s another exception. You will need to go back and get fresh consent. In other words, and as so many of our clients keep wanting us to confirm, what you have done to comply with GDPR and US/California data privacy laws does not really help you much if at all for China. You will need to undertake wholly separate and different compliance work for China. 4. China's "Trifecta" of Cyber Laws The PIPL joins China's Cybersecurity Law, implemented in June, 2017, and its Data Security Law, implemented in September 2021. China now has a trifecta of laws to make things difficult for foreign businesses. As we wrote in 2019: Under the Cybersecurity Law, the Chinese government has the right to obtain from any person or entity in China any information the Chinese government deems has any impact on Chinese security. The Chinese government understands that foreign companies and individuals will be reluctant to simply turn over their information to the Chinese government when asked. For that reason, the Chinese Cybersecurity Bureau does not plan to politely make a formal request for the information. The fundamental premise of the new cybersecurity systems is that the government will use its control of communications to simply take the information without discussing the matter with the user. All data will be open to the Chinese government. 5. Complying with China's Personal Information Protection Law Foreign and domestic Chinese companies are scrambling to hire the tens of thousands of data protection/compliance officers needed to manage the interaction with customers and ensure compliance with government regulations. Compliance is critical, because the PIPL empowers China's regulators to issue warnings, order companies to take corrective actions, suspend services and/or levy fines. Fines can be up to RMB50 million (USD$7.8 million) or five percent of an organization’s annual revenue for the prior financial year. The PIPL does not specify whether fines will be based on a company's China revenue or its revenue worldwide. Some observers have suggested PIPL's implementation should be seen as China escalating its “war on big tech”, but the law has been years in the making; the foundation was the Specification mentioned above, which was issued in 2018. No, the PIPL is an extension of Beijing’s campaign to “command and control” every aspect of Chinese life. Though Chinese and foreign companies must now handle consumer information with care, the Chinese state has total access. Our China lawyers have written often (especially during the past five years) on how foreign companies operating in China must comply with every China law and regulation. This holds true for the PIPL as well. If your company gets customer data from China, you need to make sure you stay on the right side of Chinese data privacy laws. Check Out Our China Law Services Share Twitter Facebook LinkedIn E-mail Comment Arlo Kipfer Arlo is based in Bogotá, where he advises clients on Latin America and China business issues. In addition, Arlo has advised clients on the establishment of several independent and joint venture international schools and he is a frequent speaker at international school conferences. Harris Sliwoski Attorney Read more posts [email protected] Read More AI, Internet, Web3, and Blockchain, Legal News Related Posts September 15, 2026 Your AI-Drafted China Contract Says It Needs a Lawyer. Listen to It. September 11, 2026 Forensic Accountants in China Business Litigation: How True Numbers Can Tell the Wrong Story September 4, 2026 China NNN Agreement or Trademark Registration? You Usually Need Both September 1, 2026 AI Didn't Replace Lawyers. It Gave Us the 48-Page Contract. August 27, 2026 Do I Need a China NNN Agreement or a China Manufacturing Agreement? Usually Both. August 26, 2026 China’s New Overseas Investment Rules: Can Your Chinese Investor Actually Get the Money Out? August 24, 2026 International IP Protection for Startups: What to Protect and Where August 19, 2026 The Documents Are the International Deal August 19, 2026 China Supplier Fraud in Yiwu: Why We Recommended the Police, Not a Lawsuit August 17, 2026 China Trademark Registration: Why U.S. Companies Need More Than a Filing Agent August 10, 2026 Buying Expensive Equipment from China: Seven Questions to Answer Before You Pay August 7, 2026 DDP Shipping Risks: What Boise Cascade’s Guilty Plea Means for U.S. Buyers August 6, 2026 Protecting Your Artwork Internationally: What Artists Need to Do Before the Work Travels August 5, 2026 Your China Employee Signed the Vacation Policy. You Can Still Lose. July 29, 2026 The RedNote Contract Lesson for Companies Doing Business in China Leave a comment Cancel reply