Background
To catch up with international progress on internet regulation, the Chinese government has been improving internet regulations over the past few years.
In 2021, the introduction of the Personal Information Protection Law ratified the right of individuals to their personal information and privacy for the first time. The law’s introduction and successful implementation propelled China to the forefront of international legal privacy protections. Apps began providing users with the option to erase their personal data or request copies of it.
In 2022, the Internet Information Services Algorithmic Recommendations Administrative Provisions became one of the first global regulations addressing recommendation algorithms. This regulation confirmed users’ rights to disable recommendation algorithms and avoid “echo chambers.” Since then, apps have gradually improved user control over recommendation algorithms.
Despite these advances, a key problem remains unaddressed: China’s “real name verification” requirements. Since 2017, in an attempt to control public speech, China has required all platforms where users can post publicly to collect users’ government-issued ID information. Chinese platforms typically do this by collecting users’ phone numbers, which are linked to IDs at ISPs. However, the practice has expanded beyond just collecting phone numbers. Many platforms now require users to provide sensitive ID information, and data leaks are rampant.
The New Internet ID
To solve this problem, the Chinese government is introducing the “Internet ID.” The Internet ID system is similar to OAuth2 systems like “Sign In with Google” and “Sign In with Apple,” but it is offered by the government and allows individuals to securely verify their identity online.
If individuals use the Internet ID system, third-party internet services will not receive their raw government ID numbers. Instead, they will receive a masked anonymous ID. Each service will receive different masked IDs to prevent cross-service tracking. Theoretically, the new Internet ID can fully protect privacy while maintaining the “real name” system.
Concerns
That is only theoretically speaking, however. In practice, many issues need addressing. Here are a few:
Privacy and Individual Rights
Despite protecting personal information from third parties, the Internet ID introduces another privacy issue: the government. The government will be able to see a centralized list of accounts on Chinese platforms if individuals verify their identities using the Internet ID. This centralization allows the government to block a person’s access to internet services with a single click. This is concerning, given the government’s poor track record with storing and controlling personal data during COVID-19.
This severe invasion of personal privacy is probably unfixable. It’s a balancing act: do you trust private companies or the government more with your data? The “real name” system inherently poses this unsolvable quandary. Ideally, the “real name” system shouldn’t exist, as it has a chilling effect on freedom of speech and violates personal privacy rights.
Retroactivity
The Internet ID enhances privacy by stopping providers from collecting personal IDs, but it came too late. After the “real name” system’s implementation, people’s personal information, including government IDs, was leaked extensively. A new privacy-protecting Internet ID system does not erase existing leaks.
The real effects of the Internet ID system will only be seen decades in the future, which might not be bad. If successfully implemented, new citizens born in the 2020s will have better privacy protection from companies. However, the Internet ID’s effects will remain limited for now.
Bureaucracy
Starting a web service in China is already burdensome. You must register your website with the government and set up a company and obtain licenses if you want to gain any revenue. The difficulty of connecting with the Internet ID system remains a concern. The system’s prevalence will be limited if individuals cannot work with it.
Currently, there are no instructions available for developing with the Internet ID system. This is understandable, given that the system is in its early stages. However, concerns remain about the potential bureaucracy involved in working with it.
Theoretically, It Works Great
Theoretically, the Internet ID is the perfect system to solve privacy invasion problems regarding government IDs. In practice, however, the system is a duct tape solution for the fundamentally flawed “real name” system and brings its own issues.
Over the past few years, the government has been making small attempts at protecting individual rights, which is the right direction. The successful implementation of the Personal Information Protection Law and the recommendation algorithms regulation inspires some confidence. As with all regulations and innovations, implementation is key. We’ll have to wait and see how it goes.
(August 3, 2024)