The proposed regulations outline minimum operational, data security, and user protection requirements for service providers, incorporating multiple provisions designed to enhance user control over personal accounts while curbing deceptive interface designs.
Under the draft circular, digital platforms must provide tools for users to proactively manage account information and interaction history.
Users must be able to review access logs, lock, suspend, or delete accounts, except where legal exemptions apply.
Crucially, platforms must enable users to request the permanent deletion of account-generated data, excluding state agency platforms or statutory exceptions.
In addition to data deletion requests, platforms are required to offer user interfaces that extract and download account-generated data.
Users will also hold the right to approve or reject personal data sharing outside the platform. Furthermore, platforms must display a list of linked third-party applications with active data access, allowing users to disconnect or revoke permissions at any time.
The draft circular dictates that digital platforms adopt a user-centric design approach, prohibiting ambiguous interface features or deceptive tactics that mislead users into unintentional decisions.
Platforms are strictly forbidden from executing covert auto-renewals, automated confirmations, or setting default configurations that act on behalf of users.
Notably, platforms must publicly disclose processing algorithms that affect user rights, choices, and decision-making processes.
These rules aim to provide users with clear insight into platform operations, active choices, and account-related rights.
Strict guidelines are also set for managing user data. Platforms cannot provide user data, including behavioral data, to external parties without prior notification and explicit user confirmation.
Platforms are barred from combining user data across services outside user control. Moreover, user-provided data cannot be shared with third parties for advertising purposes without explicit user consent.
Platforms must establish channels to receive and handle user feedback, disclosing support contact details including phone numbers, emails, and direct communication channels.
For platforms leveraging artificial intelligence (AI) for customer support, the draft mandates an option to transition seamlessly to human agents.
Platforms must integrate post-transaction satisfaction surveys and track metrics including completion rates, error rates, processing times, and assistance request rates.
The draft introduces official labeling requirements for digital platforms. Platforms subject to mandatory minimum standards must complete labeling and disclosure protocols prior to the implementation deadline of July 1, 2027.
Platform labels are designed to help users identify whether minimum compliance requirements are met, presenting identification codes, platform types, and independent verification status.
The draft establishes two label categories: one for platforms certified through third-party testing and verification, and another for platforms self-declaring compliance without independent audit.
Mandatory minimum compliance applies to platforms funded, built, or leased by state agencies; public-private partnership platforms; and platforms delivering online public services, essential services, or public utility functions.
The Ministry of Science and Technology encourages all other digital platforms to adopt labeling and information disclosure voluntarily once the circular takes effect.
Google translate