(Personal information includes but is not limited to the IMEI, IMSI, device MAC address, software installation list, location, contacts, call logs, calendar, SMS messages, user's phone number, images, and audio and video files. For details, see Information security technology—Personal information security specification.)
If an app does not notify users of the purpose, method, and scope of personal information processing in proper forms, for example, using a pop-up window to inform users of the personal information processing rules, the app shall not collect any personal information of users.
If your app involves personal information processing, the processing purpose, method, and scope must be clearly stated in the form of a privacy policy pop-up window or another similar method which provides the personal information processing rules, as well as the purpose, method, and scope of personal information collection when the app is in unattended mode or running in the background.
The privacy policy must contain the following information: (1) the types, purpose, method, and scope of personal information collected; (2) whether personal information is collected when the app is in unattended mode or running in the background.
The app must notify users of the purpose, method, and scope of personal information processing by third-party SDKs in the form of a privacy policy pop-up window or another similar method which provides the personal information processing rules. The third-party SDKs shall not collect any personal information.
If the third-party SDKs integrated by your app involve personal information processing, the privacy policy of your app shall specify the purpose, method, and scope of such personal information collection.
If the third-party SDKs integrated by your app involve personal information processing when your app is in unattended mode or running in the background, the privacy policy of your app shall specify the purpose, method, and scope of such personal information collection.
Requirements:
1. Complete SDK information: Disclose all third-party SDKs used in the app individually in the privacy policy.2. Accurate SDK information: Ensure that the SDK information in the app's privacy policy matches that on the National SDK Management Service Platform , including but not limited to the SDK name, developer name, collected information, purpose, and privacy policy link .
3. Secure and compliant SDK usage: Apps should not integrate risky or non-compliant SDKs (such as versions with known vulnerabilities or SDKs that are no longer maintained). If any risky or non-compliant SDKs are identified during self-inspection, they must be updated or replaced immediately.
References:
The app must provide the developer's privacy policy, and the developer name and app name in the privacy policy must be consistent with those submitted in AppGallery Connect.
Common problems are as follows: (1) The privacy policy does not contain the developer name; (2) The developer name in the privacy policy is inconsistent with the name of the developer who uploads the app; (3) The app name in the privacy policy is inconsistent with that submitted by the developer.
The app must notify users of the purpose, method, and scope of personal information processing by the app (including third-party SDKs integrated by the app) in a privacy policy pop-up window or another similar method that provides the personal information processing rules. Without users' consent, the app (including third-party SDKs integrated by the app) shall not collect any personal information, except as otherwise stipulated by laws and regulations.
√ Three compliance rules
1. There should be an agree option in the pop-up window that displays the personal information processing rule (privacy policy).
2. The personal information processing rule (privacy policy) needs to declare the purpose, method, and scope of the app (including third-party SDKs integrated) in obtaining and processing users' personal information and permissions.
3. Before a user agrees to the personal information processing rule (privacy policy), your app and third-party SDKs integrated shall not obtain the user's personal information or request permissions.
When asking for users' consent, the app shall provide explicit options of consent and rejection. Such options should not be "OK", "FINE", "GOT IT", "I UNDERSTAND", "I ACKNOWLEDGED", "I HAVE READ IT", "GET STARTED", and "NEXT STEP", or any other expressions that cannot clearly express users' consent.
When asking for users' consent, the app shall not set giving consent as the default option.
Common problems are as follows: (1) The privacy policy pop-up window does not provide a rejection option; (2) The privacy policy pop-up window does not provide a check box but instead uses "sign-in indicates consent" to obtain users' consent; (3) A privacy policy pop-up window is displayed on the sign-up and sign-in page, but the check box for users' consent is checked by default to obtain users' consent.
The privacy policy and other data collection and usage rules should be written clearly, for example, the font size should be big enough to read, and text should be appropriately spaced out, not too light, concise, complete, and not be blurred. A version of this policy in Simplified Chinese should also be provided.
Your app must highlight the purpose, method, and scope of its processing of personal sensitive information by using bold fonts, a large font size, and eye-catching colors.
