The Measures for the Security Management of the Application of Face-Recognition Technology (Order No. 19 of the Cyberspace Administration of China and the Ministry of Public Security) were reviewed and adopted by the executive meeting of the Cyberspace Administration of China on 30 September 2024 and took effect on 1 June 2025. The Measures implement the authorisation in Article 62 of the Personal Information Protection Law to make dedicated rules for new technologies such as face recognition, turning data-compliance requirements for “face-scanning” scenarios into an operable set of filing and security rules.
For users of face-recognition technology — including many AI companies that call face recognition in access control, identity verification, payments and content moderation — the trigger for this set of rules is very concrete: one numeric threshold plus one deadline.
The filing trigger: 100,000 people and 30 working days
The Measures provide that a personal information processor must, within 30 working days from the date on which the number of stored face information processed using face-recognition technology reaches 100,000 people, complete filing with the cyberspace authority at or above the provincial level where it is located.
The threshold is calculated on “storage volume”, not “number of processing operations”, which is easily misjudged. Companies need to inventory the face information they actually retain, not the number of calls or daily active users. For existing businesses that have accumulated historical face data, the threshold may have been crossed earlier than expected, and it is necessary to work backwards to confirm whether the filing obligation has already been triggered.
The five documents required for filing
The Measures specify five categories of documents to be submitted: basic information about the personal information processor; the purpose and method of face-information processing; the volume of stored face information and security protection measures; the processing rules and operating procedures for face information; and the personal information protection impact assessment report.
Among these five, the last is the most commonly underestimated. The impact assessment report must be built on a prior assessment rather than written afterwards — which means the real starting point of filing preparation is completing a genuine personal information protection impact assessment. For related assessment methodology, see our Data Compliance service page.
Changes and deregistration are also time-bound
Filing does not end with a single registration. Where filed information undergoes a substantive change, the change must be filed within 30 working days of the change; where the application of face-recognition technology is terminated, deregistration must be completed within 30 working days of termination, and face information handled lawfully.
Business adjustments, system migrations and product shutdowns can each trigger a change or deregistration. Companies should bring these milestones into internal processes to avoid procedural defects from untimely filings.
The “non-mandatory” principle: not the only verification method
The Measures establish a principle with the most direct impact on product design: where the same purpose can be achieved or the same business requirement met by other, non-face-recognition means, face-recognition technology may not be used as the sole verification method. Where an individual does not consent to identity verification via face information, other reasonable and convenient methods must be provided. Where the State provides otherwise, those provisions apply.
This rule expressly rejects the proliferation and compulsory use of “face-scanning” to check into hotels or enter residential compounds. Products that design face recognition as the only entry point need to add alternatives at the product level. At the same time, the Measures encourage the use of channels such as the national population basic information database and the national online identity authentication public service in priority to verifying identity and identifying specific individuals.
Installation in public places is also bounded: it must be necessary for maintaining public security, with the collection area determined lawfully and reasonably and prominent notices posted; no organisation or individual may install face-recognition equipment inside private spaces such as hotel guest rooms, public bathrooms, public changing rooms or public toilets.
Several hard requirements in the processing rules
Beyond filing, the Measures set out specific processing rules, several of which must be implemented at the system level: where face information is processed on the basis of individual consent, separate consent must be obtained; where the face information of minors under 14 is processed, the consent of a parent or other guardian must also be obtained. Unless otherwise provided by laws or administrative regulations or where separate consent has been obtained, face information must be stored within the face-recognition equipment and may not be transmitted externally via the internet; the retention period may not exceed the shortest time necessary to achieve the processing purpose.
The requirement to “store within the equipment and not transmit via the internet” has the greatest impact on system architecture. Solutions relying on cloud-based face-database matching need to assess whether they have a legal basis or separate consent, or may need to adjust their architecture.
R&D and algorithm training are excluded
The Measures carve out a clear exemption: applying face-recognition technology to process face information within China for the purpose of R&D and algorithm training in face-recognition technology is not subject to the Measures. This preserves space for technical work and algorithm iteration, but the exemption is limited to R&D and training scenarios and does not cover products and services offered to the public.
What this means for AI companies
First, inventory the stock before deciding on actions. Whether the storage volume reaches 100,000 people is the sole threshold for the filing obligation and must be based on actually retained data. Face data is often scattered across multiple business systems, so the inventory itself requires cross-team coordination. Where the processing scale grows further and multiple personal information processing businesses are involved, the designation and obligations of a “large personal information processor” may also be triggered.
Second, treat the impact assessment as a precondition for filing, not an ancillary document. Only a solid assessment produces a substantial report that can withstand follow-up review.
Third, address architectural issues early. The requirements to “store within the equipment and not transmit via the internet” and to avoid a “sole verification method” directly affect product plans and technology choices; the later the adjustment, the higher the cost. For support on inventorying face information, organising impact assessments, preparing filing documents and adjusting architecture for compliance, see our Data Compliance and Algorithm Filing services.
This article is based on the Measures for the Security Management of the Application of Face-Recognition Technology (Order No. 19) published in March 2025 by the Cyberspace Administration of China and the Ministry of Public Security. It is for reference only and does not constitute legal advice. Specific compliance judgements should be based on the official text and applicable law.