In May 2025, the Ministry of Public Security (MPS) and the Cyberspace Administration of China (CAC) jointly issued the Administrative Measures for the National Network Identity Authentication Public Service (hereinafter referred to as the measures), which will take effect on July 15, 2025.

What is Network Identity?

China has been enforcing real-name authentication regime for online service for several years. Some online services such as virtual payments require users to provide their real name, ID number and phone number before gaining access to the service.（the phone number is bonded to ID） However, such authentication practices may expose users and online platform operators to potential risks of personal data breaches and other privacy related scandals. Therefore, to address these concerns, the concept of Network Identity was invented in China to allow users and the platform operators to maintain the necessary authentication process while reducing the risk of misuse and leakage of sensitive and personal information.

Network identity is a form of virtual identity that allows users to use authentication service without disclosing much of their personal information such as their real name, phone number and ID number to the platform. Network Identity consists of two elements: a Network Number and a Network Certificate.

Together, these components enable secure and privacy-preserving identity authentication for online services.

To date, the National Network Identity Authentication Service has been piloted across multiple sectors, including e-government, education, healthcare, postal services, transport, and tourism. It is rapidly becoming an integral part of the public service sector. To further the application of the network identity authentication service, establishing a robust legal foundation and a stringent management system has become essential. In response to the need, the MPS and the CAC gathered four other government agencies to jointly develop these measures.

The measures contain 16 articles, covering four key areas:

1.         Clarification of the concepts of the National Network Identity Authentication Public Service, network ID codes, and digital ID certification, as well as the procedures for obtaining them;

2.         Definition of the legal validity and application scenarios for the use of the National Network Identity Authentication Public Service.

3.         Emphasis on the responsibilities of the National Network Identity Authentication Public Service Platform, internet platforms, and other relevant entities regarding data security and personal information protection;

4.         Establishing special provisions for minors regarding the application for and use of the National Network Identity Authentication Public Service.

Although the measures encourage the public to adopt the Network Identity, they still uphold to a principle of voluntary participation. In other words, users can choose not to obtain their customized Network Identity, and the platforms are prohibited from coercing users to do so. Despite the rollout of the Network Identity Authentication system, platforms are required to retain the original real-name authentication channel for their users.

How Does the Measures Regulate the Protection and Processing of Personal Information ?

The Measures impose strict data minimization principles on both data collection and provision. When users opt to use a Network Number or Network Certificate, internet platforms cannot request additional plain-text identity information unless legally required or with explicit user consent. Similarly, the National Network Identity Authentication Public Service Platform may collect only data strictly necessary for authentication.

When providing data to platforms, the Public Service Platform may supply only verification results, not full identity details — unless required by law and with the user’s separate consent. If assisting authorities, it may only disclose information tied to the Network Number/Certificate and authentication logs.

Finally, the platform must inform users and obtain their consent for all personal data processing, with separate consent required for handling sensitive personal information.

What Other Measures Are in Place to Ensure Data Security?

•        China is using anonymization technology based on national-standard encryption algorithms, ensuring that identity data is "usable but not visible" to unauthorized parties.

•        A comprehensive data security framework protects data throughout its full lifecycle, with classification and management aligned to business needs, compliance, and risk factors.

•        Strict access controls, approval processes, and full auditing ensure that data usage is legal, controlled, and fully traceable. Role-based permissions and unified access points further enhance operational security.

•        The platform conducts regular attack-defense exercises, risk assessments, and encryption reviews to maintain proactive defense capabilities and continuously improve overall system security.

The launch of the Administrative Measures for the National Network Identity Authentication Public Service marks another step in China’s efforts to strengthen digital identity governance and personal data protection. As the Network Identity system moves toward broader adoption across key sectors, it will play an increasingly important role in balancing security, privacy, and user convenience in China’s digital ecosystem. For European stakeholders, understanding the implications of this evolving framework will be essential for ensuring compliance in China’s digital market, particularly how the measures links to cross-platform data practices, and cybersecurity requirements.

If you have any questions or need further assistance, please reach us at: info@bestao-consulting.com.

BESTAO presents free monthly report on China compliance. It offers a comprehensive solution on observing various standards and regulatory activities in China. Sample of the monthly report please refer to：

https://www.bestao-consulting.com/detail?id=1740&status=bestao_library

Subscribe the free monthly report by register as a BESTAO website member at: https://www.bestao-consulting.com/login, or write an email to assistant@bestao-consulting.com.