Digital business in China: overview
A Q&A guide to digital business in China.
The Q&A gives a high level overview of matters relating to regulations and regulatory bodies for doing business online, setting up an online business, electronic contracts and signatures, data retention requirements, security of online transactions and personal data, licensing of domain names, jurisdiction and governing law, advertising, tax, liability for content online, insurance, and proposals for reform.
To compare answers across multiple jurisdictions, visit the Digital Business Country Q&A tool.
This Q&A is part of the global guide to digital business law. For a full list of jurisdictional Q&As visit www.practicallaw.com/digital-business-guide.
There is no single law or regulation in the People's Republic of China (PRC) governing conduct of business activities online. In addition, many regulations and notices regulating online businesses are sector-specific. The following laws, regulations, measures and notices are relevant to online businesses:
The PRC Electronic Signature Law.
Decision of the Standing Committee of the National People's Congress on Strengthening Information Protection on Networks.
Rules for Protection of the Personal Information of Telecommunications and Internet Users.
The Commercial Encryption Administrative Regulations.
The Guidelines for Standardising the Standard Terms of Contracts for Online Trading Platform.
Electronic Payment Guidelines (No.1).
The Administrative Measures on Non-Financial Institutions Payment Services.
The Administrative Measures on Non-Bank Payment Institution Network Payment Business.
The PRC Advertising Law.
The sector specific nature of how online businesses are regulated means that the legislative power is spread among various government authorities in China, in addition to the National People's Congress, the State Council and the Supreme People's Court, which all have legislative power.
Government authorities which are frequently involved in promulgating regulations, administrative measures and notices relating to, and regulating online businesses include the:
State Administration of Industry and Commerce.
Ministry of Industry and Information Technology.
Setting up a business online
If a company is a foreign company, the most important step is to consider whether the online business concerned, if conducted in China, will be subject to any foreign investment restrictions. The restrictions can take the form of a complete prohibition (for example, operating and publishing online games) or a cap on the equity interest which a foreign company can hold in the PRC operating company. In addition, there may be a requirement that the state must hold a majority interest in the PRC operating company.
The current Foreign Investment Industrial Guidance Catalogue, published in 2015, classifies various industries into three categories: "encouraged", "restricted" and "prohibited". The latter two categories will be the most relevant in considering if a foreign company can conduct the online business concerned in China. The catalogue only sets out different classifications. It is still necessary to consider other specific regulations and laws to determine the exact restrictions and requirements which a foreign company must adhere to.
The key impact of the foreign investment restrictions is that a foreign company may not be able to simply acquire an existing online business in China which has been operating by a PRC domestic company.
Domestic PRC company
A domestic PRC company (that is a company owned by PRC citizens or domestic PRC companies) is not subject to foreign investment restrictions. However, such company will still be subject to restrictions which require the majority interest of the relevant operating company to be owned by the state.
Local presence and form of operating vehicle
The foreign investment requirements and restrictions, together with other licensing requirements, will dictate the vehicle which a foreign company may be required to set up in China to conduct the online business. In most cases, if a foreign company is subject to foreign ownership restrictions, the foreign company will be required to set up an equity joint venture (EJV) with its PRC partner. The EJV will then hold all the required licences to conduct the online business. If a foreign company wishes to acquire an existing business, it may need to "convert" the existing PRC domestic company into an EJV.
There is no legal requirement under PRC law that before services and products can be offered through an online business to people or businesses in China, a company must set up a corporate presence in China. Many online businesses serving users and customers in China do so remotely. Very often, there are factors other than legal requirements that determine if a presence (such as a corporate vehicle or a representative office) should be set up in China. Such factors can include tax, employment local billings and foreign exchange control.
Specific operating permits
In addition to determining whether the online business is subject to foreign investment restrictions, it is also important to determine if the proposed online business requires specific operating permits or approvals or may be subject to any registration or recordal requirements. There are very few online businesses in China which are not subject to some form of approval or permit requirements.
A new online business can engage a website developer and internet service provider to develop and host the website. An existing business may also consider "localising" its existing website if the website is to be hosted in China. The localisation is to ensure that the website if hosted in China will be in compliance with PRC legal requirements. For example, PRC law requires certain information to be set out in a website (see Question 35).
An online business usually contracts with the following third parties:
Domain name registrar. A domain name registration agreement sets out the terms of a licence to use a domain name granted by the domain name registrant (see Question 23).
Website developer. A website development agreement should address the online business's requirements on the performance, functionality, security and visual design of the website, maintenance obligations, and the ownership of intellectual property rights (for example, in the design of the web pages and underlying software).
Internet service provider. Website hosting agreements should address the uploading, storage, security, maintenance or support of the website, the specification of the server, and service levels or minimum availability requirements of the hosting services.
Payment services providers. If a business sells services and products online, it needs to co-operate with payment services providers in order to facilitate online payment.
Businesses generally enter into app development agreements with software companies (app developers). Agreements should include the necessary software and content licences required to develop or distribute the app. They should also include details on the ownership of intellectual property rights in any newly created or modified content or software.
In China, apps are distributed through local app stores operated principally by four groups of providers:
Handset manufacturers (for example, Huawei and Xiaomi).
Third party app store operators (for example, 360, Tencent, Wandoujia and Baidu).
O/S operators (for example, Apple app store).
Telecom operators (for example, China Unicom's WoStore).
Businesses enter into distribution or co-operation agreements with the app store operators to have their app distributed. Businesses also enter into end user licence agreements, which provide the terms and conditions that end users must accept in order to download and use the apps.
If the app is a game, it must be approved by relevant regulatory authorities, such as the State Administration of Press, Publication, Radio, Film and Television, before it can be published or distributed in China.
Running a business online
The PRC Contract Law generally provides that contracts can be in written, verbal or other forms. The written form stipulated in the PRC Contract Law is defined as "any form that can show the described contents visibly, such as written contractual agreements, letters and electronic messages (including telegrams, telexes, fax, electronic data interchange and e-mails)". Under the PRC Contract Law, electronic contracts will be legally recognised as a written form of contracts on the basis that an electronic contract will be based on electronic messages.
Where the parties conclude a contract through electronic messages, they may require that a letter of confirmation is signed before the conclusion of the contract. The contract will be considered as signed when the letter of confirmation is duly executed.
To form a valid contract, including electronic contract, offer and acceptance are required. When contracting online, business should particularly consider offer and acceptance and the incorporation of terms.
Offer and acceptance
For a business to have control over the terms of the contract, a website's terms and conditions usually state that:
By completing an online form or order, the customer is making an offer.
When the business receives an order, it will communicate its acceptance of the customer's offer.
If the recipient has designated a specific system to receive an electronic message, the time when the electronic message enters the system will be the time of receipt. If no specific system is designated, the time when the electronic message first enters any of the recipient's systems is deemed as the time of its receipt.
Incorporation of terms
The terms of the contract must be sufficiently brought to the attention of the customer before the contract is made. If not, the standard terms of the business will not be successfully incorporated into the contract. In practice, the most effective way is to design the website so that the customer must scroll down to the bottom of the entire set of terms and conditions on-screen and click an "I accept" button (or similar) before he or she can complete the order.
Enforceability of click-wrap, browse-wrap and shrink-wrap contracts
Generally, if click-wrap, browse-wrap and shrink-wrap contracts satisfy the general legal requirements for effective contracting under PRC law, including the PRC Contract Law, these contracts will be enforceable under PRC law.
Generally, law applicable to offline contracting, such as the PRC Contract Law, will also apply to internet or online contracting. In addition, the PRC Electronic Signature Law is also relevant for online contracting. It recognises, under prescribed circumstances, electronic data messages having the same legal effect as an original document or a written document.
In addition, businesses which operate an online platform and use standard contracts, such as a user registration agreement, are subject to the Guidelines for Standardizing the Standard Terms of Contracts for Online Trading Platforms. The Guidelines were promulgated by the State Administration of Industry and Commerce in July 2014.
PRC law recognises most contracts that are formed electronically.
However, there are exceptions for certain types of contracts which, under the PRC Electronic Signature Law, cannot be contracted electronically, for example:
Documents involving personal relations, such as marriage, adoption and succession.
Documents involving the transfer of rights in immovable property, such as land and buildings.
Documents involving the cessation of water supply, heating supply, gas supply and electricity supply, and other public utility services.
Other circumstances under which electronic documents cannot be used, as prescribed by laws or administrative regulations.
The PRC Electronic Signature Law allows electronic contracts to be entered into if agreed between the parties, subject to certain exceptions (see Question 8). Where a contract can be entered into electronically, it can also be retained in electronic form, provided that where:
There is any legal requirement that a contract must be in written form, an electronic contract satisfies this requirement as long as the content of the electronic contract concerned can be retrieved, consulted and used at any time.
There is any legal requirement that a contract must be in its original, an electronic contract satisfies such legal requirement as long as the contents may be retrieved, consulted and used at any time, and there is reliable assurance that the integrity and completeness of the contents have been maintained, and there has been no modification since its finalisation.
There are any requirements in laws and regulations relating to document retention, an electronic contract will be deemed to satisfy such requirements if:
the contents may be effectively displayed, retrieved, consulted and used at any time;
its format is identical to the format at the time of its creation, sending or receipt, or if there is any difference in the format, the contract accurately displays the original content at the time of its creation, sending or receipt; and
the identity of the sender and recipient of the electronic contract can be identified as well as the time of sending and receipt.
In addition, if any information contained in an electronic contract contains state secret, the PRC State Secret Law requires such data to be retained and kept in China unless the approval of the National Administration for the Protection of State Secrets is obtained for its transfer to a place outside China (see Question 16).
There are no official government accreditations for websites in China. However, some accreditations may be of interest to website providers wishing to operate in China, for example:
China Electronic Authentication Industry Alliance, under the instruction of the Ministry of Industry and Information Technology.
China Electronic Commerce Association, the national institutional organisation, supervised by the Ministry of Industry and Information Technology and Ministry of Civil Affairs.
Trusted Website of North Dragon Net (Beijing) Technology Co., Ltd., supported by China Internet Network Information Centre.
E-signatures are recognised under PRC law, specifically, under the PRC Electronic Signature Law, if certain conditions are met. Generally parties can agree with each other whether to use electronic signatures as part of their contracts, and there is no legal requirement that electronic signatures must be used.
Definition of electronic signatures and reliable electronic signatures
An "electronic signature" is defined under the PRC Electronic Signature Law as "data in electronic form, which is included in or attached to a data message, for purposes of verifying the identity of the signatory and indicating the signatory's acknowledgement of the content of the data message".
Under the PRC Electronic Signature Law, an electronic signature will be regarded as a "reliable electronic signature" if it satisfies the following conditions:
At the time when the data created for electronic signature is used as an electronic signature, such data is exclusively owned and controlled by the electronic signatory.
At the time when the electronic signature is used, the data created for the electronic signature is exclusively controlled by the electronic signatory.
Any alteration made to the electronic signature can, following its use, be uncovered.
Any alteration made to the content and form of any data message can, following the use of the electronic signature, be uncovered.
Effect of reliable electronic signatures
The PRC Electronic Signature Law provides that a reliable electronic signature has the same legal effect as a handwritten signature or a seal/chop.
Format of e-signatures
There is no specific format required for the electronic signature or a reliable electronic signature.
Under the PRC Electronic Signature Law, electronic signatures and reliable electronic signatures) will not have the same legal effect as other recognised forms of signature in the following circumstances:
On documents involving personal relations, such as marriage, adoption and succession.
On documents involving the transfer of rights in immovable property, such as land and buildings.
On documents involving the cessation of water supply, heating supply, gas supply and electricity supply, and other public utility services.
Other circumstances under which electronic documents cannot be used as prescribed by laws or administrative regulations.
Implications of running a business online
Cyber security/privacy protection/data protection
As of the date of this publication, China does not have a dedicated piece of data protection law which has general application. However, there are a number of provisions in various PRC laws and regulations that provide protection of an individual's personal information.
The key general legislation with references to protection of personal privacy includes the:
PRC General Principles of Civil Law.
PRC Tort Liability Law.
These statutory provisions on protection of personal privacy are quite general, and are of general application. However, their practical application on protection of personal information is not very clear.
Other key regulations promulgated in the PRC which contain specific provisions on the protection of personal information, including specific requirements on collection and use of personal information, include:
The Decision of the Standing Committee of the National People's Congress on Strengthening Information Protection on Networks issued on 28 December 2012 by the National People's Congress, which applies to "network service providers" and "other enterprises and institutions" when gathering and using electronic personal information of citizens in business activities.
The Rules for Protection of the Personal Information of Telecommunications and Internet Users promulgated by the Ministry of Industry and Information Technology on 16 July 2013 and effective from 1 September 2013. The rules do not have general application: they principally regulate the activities of collection and use of personal information by telecommunications service operators and internet information service providers.
The Administrative Measures on Online Trading issued by the State Administration of Industry and Commerce on 26 January 2014 which regulates e-commerce in China. The administrative measures apply to online merchants and providers of related services.
The PRC Consumer Protection Law (amended and promulgated on 25 October 2013 and came into effect on 15 March 2014), together with the Measures for Punishment of Infringements on Consumer Rights and Interests that came into effect on 15 March 2015. The PRC Consumer Protection Law applies to business operators in relation to the collection and use of consumer personal information.
The Regulations of the Supreme People's Court on Several Issues concerning the Application of Law in the Trial Cases involving Civil Disputes over Infringements on Personal Rights and Interests through Information Networks (promulgated on 21 August 2014 and came into effect on 10 October 2014). They set out the potential judicial recourse for an individual to protection his privacy against network users or network service providers.
In addition, there are also various other regulations and notices that impose strict non-disclosure and confidentiality obligations on individuals with access to sensitive information, including:
Medical personnel and public health authorities with respect to patient records.
Bank personnel with respect to bank customer accounts and other records.
Travel agencies with respect to tourist data.
School personnel with respect to student records.
Civil servants with respect to government records.
Insurance personnel with respect to insurance customer information and other insurance records.
For further information on data protection laws in China, see Data Protection in China: overview.
Different types of personal information are regulated in accordance with the different laws and regulations. For example:
The Decision of the Standing Committee of the National People's Congress on Strengthening Information Protection on Networks applies to electronic information that is able to identify the identity of individual citizens and electronic information concerning personal privacy of citizens.
The Rules for Protection of the Personal Information of Telecommunications and Internet Users define "personal information of a user" as a user's name, date of birth, identity card number, address, telephone number, account number, passwords and other information from which the identity of the user can be identified, either independently or in combination with other information, as well as the time and place or the user using the service and other information
The Measures for Punishment of Infringements on Consumer Rights and Interests defines "consumer personal information" as information collected by business operators during the provision of goods or services that may be used for identifying a consumer either independently or in combination with other information, including the consumer's name, gender, occupation, date of birth, ID number, residential address, contact information, income and asset condition, health condition and consumption habit, and so on.
The relevant laws and regulations provide that individuals must be notified of the purposes, methods and scope of use of information collected, and more importantly, the consent of the individuals from whom information is collected must be obtained before collecting and using such information (Decision of the Standing Committee of the National People's Congress on Strengthening Information Protection on Networks, the Rules for Protection of the Personal Information of Telecommunications and Internet Users, the Administrative Measures on Online Trading and the PRC Consumer Protection Law). However, current laws and regulations do not give guidance as to the form of the consent that must be obtained, including whether the consent must be express, or may be implied.
There are no specific limitations on the storage of personal information in the cloud under the various pieces of laws and regulations identified above. However, transfer of personal information to the cloud is likely to be regarded as a "use" of personal information, which would require consent of the relevant individuals from whom information is collected.
In addition to obtaining consent from the relevant individuals for a transfer of personal information to the cloud, online businesses should note that the PRC State Secret Law prohibits transferring information that constitutes state secrets to be transferred outside of the PRC without the approval of the National Administration for the Protection of State Secrets. The term "state secret" is widely defined, and includes matters which involve security and interests of the state. Whether certain personal information can be classified as "state secret" depends on the types of data collected by online businesses on a case-by-case basis.
Further, online businesses relating to or concerning specific sectors or industries (for example, insurance and banking), and that engage cloud service providers for storage purposes, trigger additional regulatory requirements. For example, the cloud storage arrangement must be vetted by the relevant regulator.
Currently, there is no restriction that the server of the online business must be located within China.
A number of regulations discussed above in Question 14 impose obligations on companies and internet providers (who collect personal information) to ensure the safekeeping of the data collected by implementing adequate measures, and also to ensure no unauthorised disclosure or leakage of personal information.
In particular, service providers and other enterprises and institutions must keep electronic personal information gathered in business activities confidential and not disclose, tamper with, damage, sell or illegally provide such information to any person (Decision of the Standing Committee of the National People's Congress on Strengthening Information Protection on Networks).
Online merchants and providers of related services must adopt technical and other measures to ensure security of information collected, and to prevent loss or leakage of such information (Administrative Measures on Online Trading). If any information is lost or may potentially be lost, online merchants and providers of related services must take immediate remedial actions.
The Rules for Protection of the Personal Information of Telecommunications and Internet Users impose specific security requirements on telecom business operators and internet information service providers, including requirements to:
Set up work processes and security management systems for the collection and use of personal information.
Keep proper records of users' personal information, including in paper or electronic form, and take appropriate measures to keep such information secure.
Establish internal responsibilities of each role, department and branch in relation to the management and security of personal information.
Monitor and inspect any information storage system containing users' personal information and take measures to prevent unauthorised access and other security and anti-virus measures.
Manage the authority of staff and agents and set up procedures for internal monitoring of any handling, export, copying or destruction of personal information.
Take measures to prevent the unauthorised disclosure or leakage of confidential information.
Carry out any communications network security protection measures, and any other necessary measures as may be required by the Ministry of Industry and Information Technology.
Provide training to staff in relation to protection of personal information.
Encryption is not a mandatory security measure used to protect personal information for the purposes of complying with the security requirements discussed in Question 18.
The use of encryption technology, as well as its development, production, import, distribution and sale, are subject to restrictions under the Commercial Encryption Administrative Regulations promulgated by the State Council in 1999 and ancillary rules. In particular, the regulations provide that only commercial encryption products that are licensed by the Office of State Commercial Code Administration (OSCCA) can be used, and encryption products that are produced outside of China cannot be used in China. Further, organisations and individuals from outside of China cannot use encryption products or equipment containing encryption technology in China unless they first obtain approval from the OSCCA.
The stringent requirements and restrictions relating to the use of encryption technology in China under the Commercial Encryption Administrative Regulations have raised concern in particular for organisations outside of China that seek to bring encryption products and technology into China and use such products and technology in China. A series of statements have been published further to the Commercial Encryption Administrative Regulations to clarify that the regulations only seek to regulate products and technology whose "core function" is encryption. In particular, it has been clarified that mobile phones, internet browsers and Microsoft Windows software are not regarded as products and technology with encryption as their core function, and are not subject to the regulations.
A number of government authorities and regulators have powers to access or compel disclosure of information (which may contain personal information). For example:
Under the PRC Anti-terrorism Law, internet service providers and telecom service providers must assist any national security or public security authority in conducting investigations on terrorism activities. On discovery of any communications relating to terrorism or extremism, the provider must stop its transmission, retain the relevant records, delete the communication, and report to the relevant authority.
Under the PRC State Secret Law, a public communications network provider must assist any national and public security agency on any investigation on an incident relating to the disclosure of state secret. On the discovery of any disclosure of any state secret through any public communications network, the network provider must stop such transmission, retain a relevant record, and report to the relevant public or national security agency or the relevant authority of the national administration of state secret.
Citizens and organisations must provide necessary support and assistance to state security authorities, public security authorities and relevant military authorities, and report and provide any information relating to any activities that endanger state security to the relevant authorities (The PRC State Security Law and Rules for Implementation of the State Security Law).
Under the PRC Anti-Money Laundering Law, any entity or individual that discovers any money laundering activity can report the activity to the competent administrative authority on anti-money laundering or judicial authority.
There are a number of laws and regulations which are applicable to electronic payments. For example, the Measures for Management of Electronic Banking and Guidance on Evaluation of Electronic Banking Security issued by the China Banking Regulatory Commission generally govern electronic banking business.
The Electronic Payment Guidelines (No.1) published by the People's Bank of China is the first document which sets out the liabilities of entities involved in online payment, especially the banks' liability with regard to online payment. The guidelines provide that a bank can seek damages for losses caused by third party payment service providers, which is different from the past practice. The guidelines also stipulate that banks must use customers' information appropriately, to keep such information confidential, and provide relevant information to customers promptly and periodically. The guidelines also specify the period for which banks must retain customers' information and the liability for compensation if banks disclose such customers' information.
The People's Bank of China has published a number of important regulations regulating electronic payments and related services provided by non-bank entities. The key regulations include the:
Administrative Measures on Non-Financial Institutions Payment Services published in 2010 and related implementation regulations.
Administrative Measures on Non-Bank Payment Institution Network Payment Business published in 2015.
These administrative measures define the respective obligations and rights of the parties involved in electronic payment services.
There are no specific rules or guidance that govern websites aiming at minors. Such websites must obey the rules stipulated in general laws and regulations governing websites.
Even though the PRC Regulations on Protection of Minors on the Internet has not been promulgated yet, some other laws and regulations provide protection to minors on the internet.
Under the PRC Law on the Protection of Minors (promulgated on 26 October 2012), any organisation or individual is prohibited from selling, leasing or disseminating by any other means to minors any content harmful to them including pornography, violence, homicide, terror or gambling
The state encourages the research and development of network products conducive to the healthy development of children, as well as the popularisation of new technologies used for preventing minors from overusing network.
Under PRC Law on the Prevention of Juvenile Delinquency (promulgated on 26 October 2012), no organisation or individual can sell or lease electronic publications that:
Can attract minors to commit crimes.
Feature violence, eroticism, gambling or terrorism.
Can endanger the mental health of minors.
Under Interim Administrative Measures for Internet Games (promulgated on 3 June 2010), online games targeted at minors cannot:
Cause minors to imitate social morality or criminal violations.
Include horrific, cruel or other content that prejudices the physical and mental health of minors.
Internet game operators must:
Take technical measures to prevent minors from gaining access to inappropriate games or game functions.
Limit minors' playing time and prevent minors from becoming addicted to the internet.
Linking, framing, caching, spidering and the use of metatags are subject to limitations set out by the general protection of intellectual property rights under PRC law.
If the link intentionally circumvents any subscription or restriction measures imposed by the original content owner, providing the link may not be permissible if the linking constitutes a breach of a third party's exclusive rights under applicable intellectual property rights' law.
Framing may also not be permissible if the website does not disclose the source of the content so that the user thinks that the content is provided by the website itself, and not the content owner.
In addition, if information is extracted from a third party's website, it is also necessary to ensure that the use is not in breach of the terms and conditions of that website.
The Administrative Measures for the Internet Domain Names of China (Domain Name Measures) is the key regulation governing domain name registration services and related activities in China.
The principle of "first come, first serve" is followed by service providers for registration of domain names. An applicant for the registration of a domain name must:
Submit authentic, accurate and complete information for domain name registration purposes.
Sign a subscriber registration protocol with the domain name registrar.
After completing the domain name registration, an applicant for the registration of a domain name will become the holder of the relevant domain name.
The Domain Name Measures provide that a domain name cannot contain any "negative content", for example, content which is against the basic principles of the PRC Constitution or which can jeopardize national security or disclose state secrets.
In addition, the CNNIC Implementing Rules of Domain Name Registration, based on the Domain Name Measures, regulates and standardises domain name registration services and management, especially on the required documents and information for application and registration of domain names.
Domain names themselves do not confer any additional property rights under PRC law. However, certain rights can be developed through usage. A domain name can also be protected as a registered trade mark under the PRC Trade Mark Law.
Registered trade mark
A registered trade mark must be registered with the PRC Trade Mark Office for it to become a registered trade mark. It is possible to register domain names as trade marks if they meet the requirements for registration (and consequently the registered trade mark can also be subject to invalidation or revocation).
The use of a domain name may give rise to unregistered trade mark rights for the owner and user of the domain name if, over time, it acquires the attributes of a trade mark (that is, it distinguishes the goods or services of one undertaking from those of another undertaking). Use of a domain name by a business may give rise to unregistered trade mark rights and a business may establish a reputation in the domain name. If so, and if a third party misrepresents a connection or affiliation with that domain name and as a result causes or is likely to cause damage to the business, the third party may be liable for committing an act of passing off.
Generally, a company name cannot include the name of another company. A company name must be in Chinese and cannot use foreign words, the Chinese phonetic alphabet or Arabic numbers. The company can translate its name into a foreign language, in accordance with acceptable principles of written translations. However, there is no legal requirement for such translation to be reported to or approved by the Administration of Industry and Commerce.
A company name must include the appropriate ending (for example, "Limited" or the equivalent Chinese characters). Company names (and changes to them) must be recorded with the Administration of Industry and Commerce.
To obtain a business name, the applicant must file certain requisite legal documents, including a duly completed application form for pre-registration of the intended company name with the Administration of Industry and Commerce during the pre-registration of intended company name procedure. The Administration of Industry and Commerce examines whether the applied names comply with PRC law and issues the Notice on Name Pre-Approval if the names are approved.
Jurisdiction and governing law
There are no differences between the rules that apply to online transactions and other disputes and offline transactions. The set of rules used to determine the jurisdiction in China is based on the PRC Civil Procedure Law.
Generally, the jurisdiction is established through contractual provisions, which may either:
Submit the dispute to the court with jurisdiction.
Submit the dispute for arbitration to the expressly stipulated arbitration commission or tribunal.
In a contractual dispute, under the PRC Civil Procedure Law, contracting parties can agree in writing to submit to the jurisdiction of the court at the place which has a connection with the dispute, such as the place of the defendant's or claimant's domicile, the place of the performance or signing of the contract, if the agreement does not violate the provisions of the law regarding court-level jurisdictions and exclusive jurisdictions. If the PRC courts are selected as the forum to resolve a contractual dispute, an action involving the dispute will come under the jurisdiction of the court where the defendant is domiciled or where the contract is performed.
In addition, the Judicial Interpretation on the Application of PRC Civil Procedure Law expressly provides that:
The domicile of the buyer is the place where the contract is performed.
If any delivery is involved, the place of receipt will be the place where the contract is performed.
There are no differences between the rules that apply to internet transactions and other offline transactions. Generally, where both parties are PRC entities and the subject matter concerns China, the contract must be governed by PRC law.
Under PRC law, if a contract involves any foreign-related element (for example, if one of the contracting parties is a non-PRC company), the parties concerned can choose by agreement any system of laws as the applicable governing law for the contract. Where the parties concerned have not made a choice, the laws of the habitual residence of the party whose performance of the contractual obligations fully reflect the characteristics of the contract, or other laws with the most significant connection with the contract, will apply and will be the governing law (see the PRC Law on Application of Law in Foreign-related Civil Relations).
If a tortious claim involves any foreign-related elements, under PRC law, the claim can be governed by the laws of the place where the tort is committed. Where the parties concerned have a common place of habitual residence, the laws of the common place of habitual residence apply. Where parties concerned reach an agreement in relation to the application of relevant laws for the settlement of the tort on the occurrence of the tort, the provisions of the agreement will apply (see PRC Law on Application of Law in Foreign-related Civil Relations).
There are no specific alternative dispute resolution services offered to online traders and customers in China. However, there are a number of dispute resolution options offered to certain aspects of electronic transactions and online business. For example the China International Economic and Trade Arbitration Commission (CIETAC) has formulated a set of dispute resolution rules for internet domain names, which set out the whole process for dispute resolution of internet domain names.
The key legislation in China which regulates advertising of goods and services is the PRC Advertising Law which was amended in 2015 and came into force on 1 September 2015. The law expressly provides that it is applicable to online advertising.
The PRC Advertising Law is not the only piece of legislation in China which regulates advertising activities online and via social media. There are other industry and sector-specific regulations and notices issued by different ministries and government authorities which will have an impact on how advertising activities must be carried out in the relevant sector or industry.
It is also anticipated that online advertising will be subject to further regulations as the State Administration of Industry and Commerce published in July 2015 draft Administrative Measures on Supervising Internet Advertising for public consultation.
Broadly, the PRC Advertising Law provides that the advertisements must, for example:
Be true and lawful.
Conform to the requirements of the construction of a socialist civilisation and the development of the positive traditional culture of the Chinese nation.
Not contain any false or misleading content.
Not defraud or mislead consumers.
The PRC Advertising Law contains further statutory provisions elaborating on the application of these principles.
For products and services which are subject to specific regulations, the PRC Advertising Law does not draw any distinction between whether the advertisement is placed online or offline.
For example, the PRC Advertising Law expressly prohibits the use of certain content in advertisements, such as the national flag or anthem, or words such as "national/state level", "top level" or "the best" and publication of any advertisement of medical services, drugs, medical instruments, or dietary supplements disguising as health or healthcare knowledge. These restrictions apply equally to online advertising.
The PRC Advertising Law does contain a provision specifically restricting how advertisements can be displayed online. Article 44 expressly provides that online advertising cannot affect an online user's use of the internet and any pop-up or similar form of advertisements must clearly indicate a sign for their closing such that it is possible to close such advertisements by a single click. Non-compliance with this article can result in an administrative fine of RMB5,000 to RMB30,000.
The Administrative Measures Regarding Internet Email Services (Email Measures) promulgated by the Ministry of Industry and Information Technology (which took effect on 20 February 2006), is the main legislation in China that regulates text messages or spam emails. Under the Email Measures, any organisation or individual must not directly or indirectly send emails containing commercial advertisements without the express consent of the recipient. In addition, commercial emails must bear the caption "AD" (or its equivalent in Chinese characters) in the subject heading, and senders of such commercial emails must give the recipient the choice and method of notifying the sender to cease to send further commercial emails to them.
The Ministry of Industry and Information Technology also promulgated the Administrative Provisions on Short Message Services for Communication (SMS Provisions) which took effect on 30 June 2015. The SMS Provisions set out a number of statutory requirements relating to the sending of short commercial messages by short message service providers and short message content providers. In particular, short message service providers and short message content providers cannot send short commercial messages to users without the users' consent or request. Silence is deemed to be an objection. If a user explicitly refuses to receive short commercial messages after the consent, the sending must cease immediately.
There are no specific language requirements for websites targeting China. However, under the PRC Contract Law, the validity of contract can be challenged due to serious misunderstanding or the use of standard terms if the contract terms are written in English or other foreign languages. Accordingly, businesses can avoid such risk by presenting the contract in Chinese to China-based audiences and customers.
China adopts the territorial source tax jurisdiction and the resident tax jurisdiction. Profits tax is charged on profits that arise in or are derived from China. Accordingly, whether sales concluded online will be subject to China taxation will depend on whether profits derived from the sales can be regarded as arising in or deriving from China. Meanwhile, the resident tax jurisdiction requires that enterprises which are legally set up in China or set up in accordance with the law of the foreign country (region) whose actual administration institution is in China must be charged for tax.
For enterprise income tax, both resident enterprises and non-resident enterprises must pay enterprise income tax. Resident enterprises must pay enterprise income tax in relation to their income originating both within and outside China. Non-resident enterprises that have set up institutions or establishments in China must pay enterprise income tax in relation to income originating from China obtained by the set up institutions or establishments, and income occurring outside China but having an actual connection with the set up institutions or establishments.
Non-resident enterprises that have not set up institutions or establishments in China, or have set up institutions or establishments but the income obtained by the said enterprises has no actual connection with the set up institutions or establishments, must pay enterprise income tax in relation to their income originating from China.
For business tax, all units and individuals providing services transferring intangible assets or selling immovable properties within the territory of China are taxpayers of business tax, and must pay business tax in accordance with PRC Interim Regulations on Business Tax.
For individual income tax, any individual who has a domicile within the territory of China or who has no domicile but has stayed in the territory of China for one year or longer must pay individual income tax for any income obtained in and outside the territory of China according to the PRC Individual Income Tax Law. Any individual who has no domicile and does not stay within the territory of China or who has no domicile but has stayed within the territory of China for less than one year must pay individual income tax for any income obtained within the territory of China according to the provisions of this law.
Entities and individuals selling goods and providing processing, repairs or maintenance services in China, or importing goods to China, are identified as taxpayers of value-added tax, and must pay value-added tax. Selling goods means selling tangible movable goods. If the tangible movable goods are not contained in online business, the VAT may not be charged.
At present, China is in the process of reforming its value-added tax regime which may replace the business tax regime. Business tax may be entirely or partially replaced in certain area in the future.
Protecting an online business
Liability for content online
In China, there is no single piece of legislation governing liabilities which can arise from the operation of a website.
Some key potential areas of liability for online traders and website operators are:
Copyright and trade mark infringement. If an online trader uses third party content on its website without obtaining the relevant rights or licences, it can be exposed to claims of trade mark or copyright infringement. It is often assumed that content that is made available online (particularly on social media) can be freely used, but this is not the case and use without the correct permission may constitute an infringement.
Unlawful disclosure or use of third party trade secrets.
Personal information and privacy.
An online trader or website operator may be subject to the following remedies and penalties:
If an online trader fails to comply with regulatory requirements imposed by a government authority, the authority may order the online trader not to continue, repeat or engage in the contravening conduct.
The online trader can be subject to not just civil or criminal liability but also administrative liability (for example, a fine).
Where the publication of any website content results in any tortious claims (for example, defamation, infringement of privacy, reputation or other personal rights), the claimant may be entitled to:
remedies such as the removal of the offending content from the website;
claim damages; and
demand an apology.
As a minimum, a website operator must specify at a prominent place on its website the ICP licence number or the website recordal (beian) number (Article 12, Administrative Measures on Internet Information Services (promulgated by the State Council on 25 September 2000 and amended on 8 January 2011)).
In addition, a website operator must publish the rules for collection and use of personal information of its users on its websites (Provisions on Protection of Personal Information of Telecommunication and Internet Users).
Then depending on the nature of the business of the website and the products and services to be provided under it, the website operator may also need to include additional information. For example, if the business concerns the operation of an online transaction or the provision of a trading platform for goods and services, the website operator must publish standard terms (or links to such terms) concerning the operation of the platform, including (Articles 3 and 7, Guidelines for Regulating the Standard Terms of Online Trading Platform Contracts (promulgated by the State Administration of Industry and Commerce on 30 July 2014)):
User registration agreement.
Merchant affiliation agreement.
Platform trading rules.
Rules on the collection and protection of personal information and trade secrets.
Rules and procedures on the protection of consumer rights and interests.
Dispute resolution mechanism.
A website operator must also publish at the appropriate place on the main page of its website information concerning (Article 8, Guidelines for Regulating the Standard Terms of Online Trading Platform Contracts):
Its business licence and other relevant permits.
Its business address, postal code, telephone number, e-mail, and other contact information.
It is important to check industry and sector specific regulations and requirements to ensure that the website will include all information required to be provided publicly.
Based on the PRC Tort Law, where an internet user infringes an individual's civil rights and interests through the internet, such an individual has the right to require the internet service provider to take necessary action, such as deleting the content, screening, severing the links, and so on. If the internet service provider fails to take the necessary action, it will jointly and severally liable with the internet user for any additional injury or damage suffered by the individual.
If the internet service provider becomes aware that an internet user is infringing the civil rights and interests of a third party through its internet service but fails to take necessary action, it will become jointly and severally liable with the internet user.
An internet service provider can raise the defence that the information is published by an internet user. However, the court can order the internet services provider to provide the court with the specific information of the user such as his name, contact information and IP address (Supreme People's Court's Interpretation to Trial of Civil Dispute Cases of Infringement of Personal Rights using the Information Networks).
A website operator, as the platform provider for e-commerce operator, is liable for trade mark infringement if it knows or should have known that the e-commerce operator has committed trade mark infringement but provides its trading platform to such operator regardless ( PRC Trade Mark Law and the Implementing Regulations of the Trade Mark Law ).
The Draft Fourth Amendments to the PRC Patent Law requires network service providers to bear more legal obligations matching their capability and clarifies that the network service provider's obligations in executing the decision of the patent administrative authorities. Accordingly, the website operator may have to proactively police the operation of its website to ensure that users of its website are not involved in any potential patent infringement.
In addition, a website operator is also liable for the content published on the website it operates. Articles 13 and 15 of the Administrative Measures on Internet Information Services impose statutory obligations on a website operator to ensure that the information it provides is lawful and that it will not publish any information containing content which:
Is against the important principles set out in the PRC Constitution.
Is detrimental to security of the state, state secrecy, state power and national unification.
Is detrimental to state honour and interests.
Instigates ethnic hatred or discrimination and is detrimental to national unity.
Is detrimental to state religious policy, propagating heretical or superstitious ideas.
Disseminates rumours, disrupts social order and stability.
Disseminates obscenity, pornography, violence, brutality and terror or abets crime.
Humiliates or defames others, violates the lawful rights and interests of others.
Contains contents prohibited by laws and regulations.
In relation to infringement of third party rights, in particular, intellectual property rights, Article 48 of the PRC Copyright Law, for example, provides that a website operator commits a copyright infringement act by publishing content on its website without the owner's consent.
However, a website operator will not be regarded as having committed such an infringement act if it can demonstrate to the court that it merely provides "network services" and there is no fault on its part.
For online businesses involving the publication of third party content, both the author of the content and the website operator may be liable for the infringement, depending on the wrongdoing alleged. For example, if a website operator knows or ought to know that the use by a user of its website violates the copyright of a third party but fails to take necessary measures to cease such violation, such as deleting the content or disabling the relevant linking, the website operator may be held liable for assisting another to commit an infringement act. PRC law provides that a website operator is taken to know the alleged infringement if it has received a notice from the rights owner and the website operator fails to take necessary action promptly. Accordingly, it is important for a website operator and trader to put in place a proper takedown process which will facilitate rights owners to report any potential infringement of their rights and to take relevant steps to delete or remove the infringing items from its website.
Most ISPs will be required to take down infringing websites, content or links if they infringe the civil rights of a third party.
Under the Administrative Measures on Internet Information Services, an internet content provider (for example, a website operator) is under a statutory duty to cease transmitting content referred to in Question 38. In order to ensure that this obligation is complied with, it is common practice for internet content providers to include the statutory obligation in the relevant contracts as a contractual right allowing them to take down the content if they become aware of such content being published on their website sites.
Liability for products/services supplied online
Under the PRC Tort Law (promulgated on 26 December 2009) and the PRC Product Quality Law (promulgated on 8 July 2000), the producers and sellers are subject to liability for products and services. Even though liability for products and services supplied online has not been specifically mentioned in these acts, online product and service liability are generally governed by PRC Tort Law and PRC Product Quality Law.
Under the PRC Law on Protection of Consumer Rights and Interests (promulgated on 25 October 2013), consumers whose legitimate rights and interests are infringed while purchasing goods or receiving services via the online trading platform of a third party have the right to claim compensation from the seller of the goods or the service provider. If the operator of the online trading platform cannot provide the real name, address and effective contact of the seller or the service provider, the consumers can claim compensation from the operator of the online trading platform. After compensating the consumers, the operator of the online trading platform can claim compensation from the seller or service provider.
If the operator of an online trading platform knows or should know that the seller or service provider uses its platform to commit acts that have infringed the legitimate rights and interests of customers but fails to take necessary measures, the operator bears joint and severable liability with the seller or the service provider.
In addition, the Administrative Measures for Online Trading (promulgated on 26 January 2014) require that the operators of the third party trading platform must establish control systems for settling consumers' disputes and protecting consumers' rights. When a consumer is involved in a dispute or his rights are infringed when purchasing commodities or receiving services within the platform, and he or she seeks the platform's mediation, the platform concerned must provide such support.
If the consumer tries to protect his or her rights through other channels, the platform must:
Provide the consumer with true information on the operator registered on the website.
Assist the consumer in protecting his or her legitimate right and interest.
Online auctions can be conducted by referring to Measures for the Administration of Auctions (promulgated on October 28 2015) since there are no specific laws or regulations governing online auctions. An auction company is liable for any loss incurred by the buyer if the:
Auction objects are prohibited from sale.
Auction company fails to make known any defect of the auction object to the buyer and as a result the buyer suffers a loss. If such loss is attributable to the seller, the auction company can claim compensation from the seller.
There is no specific law that governs insurance for online business. Generally, online business requires the same type of insurance as other offline businesses operating in the same industry. In addition, online businesses should consider specific insurance policies covering the risks relating to data privacy and network security in the event of a data or security breach.
There are a number of new and proposed regulations which will likely have an impact on the operation of digital business in China:
The Administrative Measures on Online Publishing Services (the Online Publishing Provisions) were issued by the State Administration of Press, Publication, Radio, Film and Television (SAPPRFT) and the Ministry of Industry and Information Technology on 4 February 2016 and came into force on 10 March 2016.
The Online Publishing Provisions provide that an online publishing service licence must be obtained for online publishing services. The Online Publishing Provisions also provide that the following types of entities are not permitted to engage in online publishing services:
sino-foreign equity joint ventures;
sino-foreign co-operative joint venture; and
wholly foreign-owned enterprises.
Any co-operation between an entity providing online publishing services and the foreign enterprises listed above in China must be reported in advance to the SAPPRFT for approval.
The draft PRC Cyber Security Law which was released for public consultation in 2015. A second draft was recently released in June 2016 for further consultation. The draft law is applicable to entities or individuals that construct, operate, maintain, and use networks within China, as well as those who have the responsibility to supervise and manage network security and will have an impact on information technology and communication companies with business operations or interests in China. The draft Cyber Security Law also contains a set of provisions on the protection of personal information.
In addition to the above regulations, in the past 18 months, various government authorities have published and conducted public consultations on draft regulations covering a variety of areas, such as the following areas:
Administration of domain names.
Advertising of specific products and services (following the amendment of the PRC Advertising Law).
Internet news information services.
Sale of food online.
When these regulations are formally issued, they will have an impact on the operation of digital business in China.
Description. Official website maintained by the Chinese government, containing regularly updated legislation (available in Chinese only).
Michelle Chan, Partner
Bird & Bird
Professional qualifications. Solicitor, England & Wales; Solicitor, Hong Kong
Areas of practice. Commercial law; technology, media and telecoms; data protection; IP law
Languages. English, Cantonese, Mandarin
Clarice Yue, Senior Managing Associate
Bird & Bird
Professional qualifications. Solicitor, England & Wales; Solicitor, Hong Kong
Areas of practice. Telecoms, media and technology; data protection, commercial law
Languages. English, Cantonese, Mandarin
Sarah Wang, Associate
Bird & Bird
Professional qualifications. Attorney, New York
Areas of practice. Corporate finance; cross-border M&A; corporate law
Languages. English, Mandarin