Common legal pitfalls for programmers and tech professionals✳
This section focuses on personal freedom and financial safety — essentially, avoiding imprisonment and costly lawsuits. Many developers and technical workers tend to treat the following issues as mere technical matters. In reality, they constitute specific criminal offenses under Chinese law or can lead to substantial civil liabilities. For each item, we list the relevant legal provisions and real-world cases published on the websites of the Supreme People’s Procuratorate and the Supreme People’s Court. The criminal law references come from a consolidated text republished by the Beijing Traffic Management Bureau, which reflects amendments introduced in the 11th Criminal Law Amendment. The items are ordered from those most likely to be underestimated by tech professionals to those with the most severe consequences. The first entry serves as a general guide: it explains how to assess risks before taking action and what steps to take immediately after any incident occurs.
English text comes from the independent translation maintained by dlgrv. New entries without a translation appear in Chinese. The author's Chinese original is authoritative for the latest content. Translation snapshot: dlgrv/HowToLiveBetter · 11818c6
Ask three questions before taking any action: Whose interests might be harmed? How capable is the other party of pursuing legal action? And how much evidence do I have? If legal action is taken, immediately hire a criminal defense attorney.
Before doing anything, ask whether the vendor, platform, or company will report the incident to police. Server logs, payment records, and chat logs are all easily obtained during an investigation. If you are criminally detained, authorities must decide within 37 days whether to formally arrest you. You may hire a lawyer from the very first interrogation onward; those 37 days are the most critical window for securing effective legal representation.
Cost
No cost at all. Before acting, replace the question “Is th…
Benefit
Any organization or individual who becomes aware of a crime may file a police report. Once authorities deem a…
02Evidence A
Refraining from creating or selling game cheats and aids, including AI tools that only capture screenshots without touching memory
Selling to just 20 users or earning 5,000 yuan is enough to qualify as “serious circumstances,” leading to a sentence of up to three years. In especially serious cases the penalty ranges from three to seven years. One developer who created aim‑assist and wall‑hack cheats sold them over 80,000 times in three months, netting more than 30,000 yuan; he received a one‑year suspended sentence plus a 5,000‑yuan fine. Another individual obtained the game’s server code, ran a private server, and collected over 20 million yuan in payments; he was sentenced to four years in prison and fined up to 10 million yuan.
Cost
There is no monetary cost. The trade‑off is giving up pote…
Benefit
Distributing programs or tools designed to intrude upon or illegally control computer systems can result in im…
03Evidence A
Do not write or sell scripts for ticket snatching, flash sales, fake orders, or coupon farming — even if they merely “automate button clicks”
Even if a script does not modify memory or bypass security measures and merely sends requests faster than a human can, it still qualifies as illegal acquisition of computer system data. The legal threshold is either earning over 5,000 yuan or causing at least 10,000 yuan in losses. One individual bought multiple 12306 accounts and used them to snatch over 200 train tickets, netting more than 20,000 yuan; he was sentenced to 1 year and 6 months in prison, suspended for the same period, plus a fine of 5,000 yuan. Another person sold ticket‑snatching software online and was found guilty of unfair competition, ordered to pay 20,000 yuan in damages.
Cost
No expense and no time required
Benefit
Illegally accessing computer systems or obtaining their data via any technical means can lead to imprisonment…
04Evidence A
The crawler only accesses publicly available pages that require no login; it does not attempt to bypass anti-scraping measures or handle any personal information, and any data it collects is never sold.
Any data that requires a login, a token, or signature decryption to access falls under bypassing protective measures; violations are punishable by up to 3 years in prison, or 3 to 7 years in more serious cases. Collecting personal information brings even heavier penalties. Possessing 50 or more records related to personal movement, communications, credit history, or financial information is already considered a serious offense. The same applies if you collect 500 or more records on accommodation, health, or transaction details, 5000 or more records of other types, or earn 5000 yuan or more from such activities.
Cost
No cost at all. A crawler is simply a program that automat…
Benefit
Illegally accessing system data by bypassing protective measures carries the same sentencing range as the thir…
05Evidence A
Refuse development orders for gambling, fraud, or adult-content apps; do not set up payment gateways or unblock accounts for such “clients”
Taking on such high-paying yet poorly defined projects means you could be treated as an accomplice in gambling crimes, facing charges under the crime of operating illegal gambling dens: up to 5 years in prison, or 5–10 years for serious cases. This is not the “merely helping out, maximum 3 years” category. In one e-sports betting app case, 28 developers in Hainan were sentenced to 1–3 years and 6 months for operating illegal gambling dens. Those who unblocked QQ accounts for fraud rings received 1 year and 6 months in prison plus a 20,000-yuan fine.
Cost
No direct monetary cost. The trade-off is forgoing outsour…
Benefit
Providing technical support or payment settlement services to known online criminals can lead to imprisonment…
06Evidence A
Upon leaving a job, return all account access rights; do not delete databases, leave backdoors, or alter password protection systems — even if the employer owes you wages.
Account credentials are issued by the employer, but they do not remain valid after you leave the job. Logging in using those credentials constitutes illegal control of computer systems, punishable by up to 3 years in prison. Deleting data to render the system inoperable is punishable by up to 5 years in prison; more severe cases incur sentences exceeding 5 years. One example: a dismissed senior engineer logged into his former employer’s servers using his original admin credentials, deleted data and logs, resulting in over 120,000 yuan in losses. He was sentenced to 3 years in prison, suspended for 5 years, and fined 30,000 yuan.
Cost
No cost involved. If the employer owes you wages, pursue t…
Benefit
Illegal control of computer information systems is punishable by up to 3 years in prison, with or without a fi…
07Evidence A
Do not take source code, client lists, or technical documents upon leaving; do not upload them to personal cloud drives or reuse them at new employers
Even code written by you personally remains the company’s intellectual property — taking it away is essentially stealing company assets. Client lists also qualify as trade secrets. In one case, a former employee who took source code and core algorithms of a security inspection system to a new employer was sentenced to 5 years in prison and fined 500,000 yuan; the new employer was fined 4 million yuan. Another individual who exploited system vulnerabilities to download over 33,000 design files was sentenced to 1 year and 10 months in prison and fined 100,000 yuan. Beyond criminal penalties, companies can also pursue separate civil compensation claims.
Cost
No cost involved. Before leaving, simply delete all compan…
Benefit
Violating confidentiality obligations by disclosing or personally using trade secrets may result in imprisonme…
08Evidence A
Do not run your own programs on others’ computers, servers, or cameras; do not use company machines for mining
Controlling someone else’s computer, server, or camera without permission is illegal. Operating 20 or more such devices qualifies as a serious offense, punishable by up to 3 years in prison; especially severe cases may incur 3 to 7 years. Even if it does not rise to a criminal offense, offenders can still be detained for up to 5 days and fined between 50,000 and 500,000 yuan. For tech professionals, the most damaging consequence is a lifelong ban from holding key positions in cybersecurity management and network operations after any criminal conviction.
Cost
No expense and no time loss
Benefit
Illegally controlling computer information systems is a crime. Serious cases result in up to 3 years in prison…
09Evidence A
Testing someone else’s systems without written permission — “good intentions” and “reporting afterward” are not excuses
Whether a crime is established depends solely on whether you had permission and how much access you obtained — not on your intentions. Possessing 500 sets of ordinary account credentials, or earning 5,000 yuan while causing 10,000 yuan in losses, is enough to warrant a sentence of up to three years. Even a single attempt to export a user list to prove a vulnerability often exceeds that 500‑credential threshold. Using credentials you already possess outside their authorized scope also constitutes unauthorized access.
Cost
No cost at all. Before joining a vendor’s SRC or public be…
Benefit
This law applies to computer information systems belonging to ordinary companies and individuals, excluding th…
10Evidence A
Vulnerabilities must be reported per regulations; no details, exploit tools, or disclosure to foreign entities before patching
The “Regulations on the Management of Security Vulnerabilities in Network Products” applies not only to companies but also to individuals. There are five strict rules for vulnerability disclosure; the first two state that no details about vulnerabilities affecting active systems may be released before a vendor provides a fix. Additionally, no programs or tools specifically designed to exploit those vulnerabilities may be published, and any release must include instructions on how to remediate them. One often-overlooked rule: unreported vulnerabilities must not be shared with any foreign organizations or individuals outside the vendor.
Cost
No cost involved. Simply report the vulnerability to the p…
Benefit
These regulations govern three main groups: domestic network product vendors, network operators, and any organ…
11Evidence B
No selling of tools for bypassing firewalls or VPN accounts, no setting up such nodes for others
Any individual or entity that builds their own outbound network connections or uses international channels outside of state-provided public telecom services may be ordered by police to cease internet access, receive a warning, and face fines up to 15,000 yuan plus confiscation of any illegal earnings. Those running businesses based on such services may be charged with illegal business operations; in severe cases, imprisonment of up to five years applies. This rule specifically addresses selling or setting up such nodes. For personal use only, the maximum penalty remains limited to a warning and fine as stipulated in Article 14 of the provisional regulations.
Cost
No expense or time required
Benefit
Direct international internet connectivity must be facilitated via international gateway channels supplied by…
12Evidence A
After signing a non-compete agreement, if the employer fails to pay compensation monthly, send a written notice; if payment still doesn’t come after 3 months, you may terminate the agreement. Workers who never handled any trade secrets can request that the clause be declared invalid.
A non-compete clause simply means you’re not allowed to work for a competitor for a certain period after leaving your job. This rule is there to protect you. The maximum duration is 2 years, and the employer must pay compensation every month. If the amount isn’t specified, it’s calculated as 30% of your average monthly wage over the previous 12 months, and it can’t be lower than the local minimum wage. If the employer fails to pay for 3 months due to its own reasons, you can ask to end the agreement. Starting in 2025, workers who never learned about or handled any trade secrets at their job can request that the non-compete clause be ruled invalid.
Cost
No cost involved. Keep the original non-compete agreement…
Benefit
Non-compete clauses only apply to senior executives, highly skilled technicians, and anyone with a duty to kee…
13Evidence A
Code written during work hours using company resources belongs to the company; personal open‑source projects should be done in your own time and on your own equipment, without mixing them.
Work‑related creations are defined as works made in the course of your duties. Software is explicitly listed in law as “copyright belonging to the employer.” If a program is primarily produced using company hardware, internal networks, or business data — and the company assumes responsibility for it — then the copyright rests with the employer. The same applies when the contract states this. As the creator, you retain only the right to be credited. Inventions developed using company resources also belong to the company, with patent rights following the same rule. Even if you write code “after hours,” using a company computer or business data can still make it qualify as a work created mainly with employer resources.
Cost
No cost involved. When you start a new job, be sure to rea…
Benefit
Works produced to fulfill job duties are considered “work‑made‑for‑hire.” Under normal circumstances the autho…
14Evidence B
Using open-source code such as GPL in products: comply with licensing requirements by open-sourcing or switching licenses; this does not mean “no one cares”
Copyright infringement requires compensation based on the actual losses suffered by the rights holder or the profits you’ve earned. If neither can be accurately calculated, compensation is determined by what a normal licensing fee for that software would be. For intentional and serious violations, penalties can reach 1 to 5 times that amount. In one case, a defendant hired a former employee of the plaintiff to develop gateway software; the code was substantially similar to the plaintiff’s. The defendant argued that since the plaintiff’s software was originally based on GPLv2 and thus required to be open-sourced, no infringement occurred. The Supreme People’s Court ruled these two issues — whether GPLv2 was violated and whether copyright existed — were independent matters, and ordered the defendant to cease infringement and pay 500,000 yuan in compensation.
Cost
There is no cost involved. Before using someone else’s ope…
Benefit
Copyright infringement demands compensation calculated either from the rights holder’s actual losses or from t…
15Evidence B
Only collect personal data strictly necessary for the app’s operation; consent from guardians is required for users under 14, and the privacy policy must be clearly written.
Only gather information that is genuinely needed for business purposes, and obtain consent from a guardian for any user under 14. For violations, regulators first order corrections and issue warnings, and may also confiscate illegal earnings; the app can be ordered to suspend or terminate its services. If the violation persists, fines up to 1 million RMB can be imposed on the app, while individuals directly responsible may be fined between 10,000 and 100,000 RMB. In severe cases, fines can reach 50 million RMB or 5 % of the previous year’s revenue, and responsible personnel may face fines from 100,000 to 1 million RMB. The term “directly responsible personnel” can include the technical and product staff who actually implement the app.
Cost
No cost involved. Before launch, cross‑check the list of p…
Benefit
Personal data should be processed only for a clear, legitimate purpose that is directly related to that purpos…
16Evidence A
Before launching a website or app, complete ICP filing and retain logs for at least 6 months per classification protection requirements
ICP filing costs nothing and takes a few weeks via a cloud provider’s process. Domains cannot be resolved at all without filing for servers located within China. Entities that fail to file must first be ordered to make corrections; if they refuse, their websites are shut down. Failing to display the filing number on a homepage results in fines ranging from 5,000 to 50,000 yuan. If a site is registered as non-commercial but actually charges fees, it is treated as operating without a license: any illegal earnings are confiscated and fines of 100,000 to 1,000,000 yuan apply. Logs must be retained for at least 6 months; failure to do so results in orders to correct the issue and warnings, and if ignored or if consequences occur, fines of 10,000 to 100,000 yuan are imposed.
Cost
Filing itself is free;
Benefit
Commercial internet information services require a license, while non-commercial ones must be filed. Operating…
17Evidence B
Before offering generative AI services to the public, conduct required safety assessments and algorithm registration; mark all generated content
If you offer generative AI services with public influence or social mobilization potential to the general public, you must perform a safety assessment and register the algorithm per national regulations before launch. Any changes or shutdowns also require filing updates or cancellation paperwork. All generated images and videos must be clearly marked. Tools meant solely for personal use and not open to the public are exempt from these requirements. The regulation itself does not specify penalties; violations are handled under the Cybersecurity Law, Data Security Law, and Personal Information Protection Law.
Cost
There is no monetary cost, but you must follow procedures…
Benefit
Providers of generative AI services that can shape public opinion or mobilize people must conduct safety asses…