On 28 May 2025 the Cyberspace Administration of China issued its announcement on filing for the application of face recognition technology. The announcement turns the already-effective measures for the secure management of face recognition applications into an executable filing timetable.
Two dates that fix a company’s filing duty
The announcement sets two timelines. From 1 June 2025, where the application of face recognition technology means face information on 100,000 people is stored, filing must be completed within thirty working days of the threshold being reached. Where the threshold had already been reached before 1 June, filing had to be completed by 14 July 2025.
Existing applications and new applications therefore face different windows. Established operators face a fixed deadline; new ones face a rolling obligation that grows with the business.
What the 100,000 threshold means
The threshold is calculated by storage volume, not by user numbers, and it is triggered by reaching the figure. For a company, the key step is to make stored face information a monitored metric, rather than discovering the line has been crossed when a regulator asks. See our note on face recognition filing in practice.
How it connects to personal information protection
Face information is sensitive personal information, and its processing is already subject to a higher standard. Filing is not an isolated extra duty; it is the concretisation of sensitive information rules in the face recognition context. See our notes on network data security risk assessment measures and on obligations of major personal information processors.
Where companies can start
First, build monitoring and early warning for stored face information, preparing materials in advance as the threshold approaches.
Second, distinguish on-device storage from centralised storage; the trigger for the filing duty depends on the storage architecture.
Third, check the rules for cross-border scenarios; exporting face information is also subject to the outbound data regime. See our note on outbound personal information certification.
It is worth noting what the announcement does not do: it does not set a new substantive standard for processing face information, and it does not exempt anyone below the threshold from the underlying rules. Filing is a visibility obligation layered on top of a regime that already applies.
The point of a filing regime is to make high-risk processing visible to the regulator. The earlier a company brings it into routine bookkeeping, the less it will be chased by deadlines as the business expands.
This article is based on the Cyberspace Administration of China’s Announcement on Filing for the Application of Face Recognition Technology and public information and is for reference only; it does not constitute legal advice.