The draft from the internet regulator, the Cybersecurity Administration of China, proposes to restrict the use of the technology to instances where it has a specific purpose and is sufficiently necessary. The rules also ban the use of the technology for identifying race, ethnicity, religious belief or health status—applications that haven’t been scientifically proven—unless a person has given consent or for the purposes of national security.
The stipulations bring China’s stance on private and commercial uses of facial recognition closer to Western norms, including rules proposed in the European Union and by local governments in the U.S. It also leaves exceptions for national-security-related uses of the technology, a common feature among China’s data and security regulations.
“Within one law you have provisions that reflect an authoritarian tech-enabled superpower and also genuine concern about misuse of the technology,” said Samm Sacks, a senior fellow at Yale Law School’s Paul Tsai China Center. “That’s the sweet and sour approach of Chinese governance.”
The proposal is the latest in a series of moves by China’s government to put guardrails around how companies use data and artificial intelligence, putting it at the forefront of global attempts to regulate cutting-edge technology.
Earlier this year, the regulator implemented rules on so-called deepfakes, AI-generated media, and proposed others on generative AI tools similar to OpenAI’s ChatGPT. Last year, it began regulating the algorithms that underpin popular apps and internet platforms including TikTok’s Chinese equivalent Douyin and the ubiquitous super app WeChat.
There is no national law regulating the use of facial recognition in the U.S., even though some states including Massachusetts and cities such as San Franciscohave imposed limits, particularly with regard to law enforcement’s use of the technology. In Europe, policy makers recently agreed on a draft version of a law governing artificial intelligence, which will ban the use of real-time facial recognition in public spaces by police and other state security forces.
The Chinese rules also come after China’s Covid controls led to the blanket adoption of location logging and access-control technologies.
Graham Webster, a research scholar who heads the Stanford University-based DigiChina Project that examines China’s digital-policy developments, said the draft seems aimed at discouraging unnecessary use of facial recognition. “If enforced, it would cool the proliferation of biometric gadgetry outside security contexts,” he said.
Facial-recognition use in China has been burgeoning over the past seven years, with the means to use your face as a form of identity mushrooming in malls, office buildings, airports and hotels. Chinese consumers can opt to use their faces to pay for items in some stores, enter buildings and for identity checks before boarding a plane.
Surveillance cameras are ubiquitous in many Chinese cities, and some of China’s largest facial-recognition suppliers have partnerships with local police to provide the technology for security purposes—tracking not just criminals but also dissidents, ethnic minorities and others the government sees as threatening national security.
Such technology is at the heart of international criticism of Beijing for its treatment of ethnic minority groups in the northwestern region of Xinjiang, where the Chinese government has carried out a campaign of forced ethnic assimilation targeting Turkic Muslims. Authorities in Xinjiang have used facial recognition and other surveillance tools to track and sort Muslims, sending hundreds of thousands to internment camps for political indoctrination, according to researchers. China has rejected those allegations, referring to its policies in Xinjiang as a campaign to prevent terrorism.
Many people in China greeted the initial rollout of smart cameras with enthusiasm or indifference, adopting the technology in their everyday life. Still, Chinese leaders have faced growing unhappiness over the widespread use of facial recognition.
In a rare lawsuit over the technology in 2019, a Chinese law professor, Guo Bing, accused a zoo in the coastal city of Hangzhou of violating his consumer rights by requiring him to use a facial-recognition system to gain entrance to the zoo—and barring him when he didn’t comply. The court ordered the zoo to pay damages to Guo and delete his data but left unaddressed whether it was legal for the zoo to continue to force visitors to undergo facial recognition.
A survey of public attitudes toward facial recognition in 2019 by the Nandu Personal Information Protection Research Center, a think tank in south China, also found regular Chinese were increasingly concerned their personal information was being leaked due to a lack of data security.
Tuesday’s proposed regulation pulls together and fleshes out in one framework the restrictions on the use of face-recognition technology scattered throughout various laws in China, including in the national privacy law passed in 2021. It states, for example, that facial data shouldn’t be collected and used without consent, reiterating a key aspect of China’s 2017 Cybersecurity Law, which requires individual consent for personal-data collection.
Part of this redundancy is practical: to make clear exactly how an existing law should be applied to the facial recognition context, Webster said. Through the rules, Beijing is also signaling that it is aware of the public concerns, Sacks said.
Some provisions in the regulation go into granular detail, stating for example that facial recognition shouldn’t be used in hotel rooms, bathrooms or toilets, places where the public has heavily pushed back on uses of the technology before. It also outlaws moves by entities to pressure individuals to adopt face recognition, such as in the case of the zoo, as a method to establish their identities.
At the same time, China, under its leader Xi Jinping, has been expanding its definition of national security to cover anything seen as undermining Communist Party rule, as Xi braces the country for a potential confrontation with the West. In July, a revised and tightened anti-espionage law took effect, raising concerns among foreign governments and businesses.
The proposed regulation is the latest effort by authorities to walk the fine line between acknowledging public debate and maintaining tight control on the country’s security. “It allows the government to have both a pressure valve release through showing the public that they’re being responsive but also to deflect attention of the use of these technologies by central authorities,” Sacks said.
