Common legal pitfalls for programmers and tech professionals✳
This section’s metrics are personal freedom and money — what you get back is “don’t get locked up” and “don’t pay damages.” People who write code or do technical work often treat the items below as “just technical problems.” In fact they map to specific criminal offenses, or to a concrete civil sum you may have to pay. Each item gives the numbers in the statutes, plus cases published on the websites of the Supreme People’s Procuratorate and the Supreme People’s Court. Criminal-law citations use the consolidated text “as amended by Amendment (XI) to the Criminal Law” republished by the Beijing Traffic Management Bureau. Item 1 is the general one: how to judge before you act, and what to do first if something goes wrong. Items in this section are grouped by theme below; numbers in parentheses are item numbers. Before you act: Before acting, ask whether anyone will file a police report (item 1). Cheats, scripts, and cracks: Game cheats and aids (item 2); ticket-snatching, fake-order, and coupon-farming scripts (item 3); crawl only public pages that need no login (item 4); tools that auto-skip or block ads in other apps (item 18); crack patches and keygens (item 20). Touching others’ systems: Do not run your programs on others’ computers (item 8); do not test others’ systems without written authorization (item 9); report vulnerabilities as required (item 10); DDoS traffic attacks (item 21). Side gigs and client work: Development orders for gambling, fraud, or adult-content apps (item 5); circumvention tools and VPN accounts (item 11); AI relay sites (item 19). Leaving and ownership: Hand over account access when you leave (item 6); do not take source code when you leave (item 7); non-compete agreements (item 12); code written with company resources belongs to the company (item 13); GPL and other open-source code (item 14). Shipping a product: Collect only personal information the business needs (item 15); complete ICP filing before launch (item 16); generative-AI security assessment and algorithm filing (item 17).
English, Russian and Spanish use dlgrv’s unofficial translations. Newly revised entries appear in the Chinese original until a checked translation is available. The author’s latest Chinese text is authoritative. Translation revision: dlgrv/HowToLiveBetter · b25fa8a
Before taking action, ask: Will the manufacturer, platform, or company report the crime? The case handling agency has the right to retrieve server logs, payment records, and group chat records. If you are placed in criminal detention, the authorities must decide within at most 37 days whether to approve arrest. From the first questioning, you can hire a lawyer. The lawyer can advise the procuratorate that the arrest should not be approved, and can also apply for bail.
Cost
No money spent. Before acting, replace “can this be done t…
Benefit
Any unit or individual who discovers facts of a crime has the right to report it. If investigating authorities…
Selling to just 20 users or earning 5,000 yuan is enough to qualify as “serious circumstances,” leading to a sentence of up to three years. In especially serious cases the penalty ranges from three to seven years. One developer who created aim‑assist and wall‑hack cheats sold them over 80,000 times in three months, netting more than 30,000 yuan; he received a one‑year suspended sentence plus a 5,000‑yuan fine. Another individual obtained the game’s server code, ran a private server, and collected over 20 million yuan in payments; he was sentenced to four years in prison and fined up to 10 million yuan.
Cost
There is no monetary cost. The trade‑off is giving up pote…
Benefit
Providing programs or tools specially used to intrude upon or illegally control computer information systems,…
Even if a script does not modify memory or crack anything and only sends requests faster than a person, it can still lead to a conviction; earning 5000 yuan or causing the other side 10000 yuan in losses is enough. Someone used bought 12306 accounts to snatch over 200 tickets, earned over 20000 yuan, and got 1 year 6 months suspended for 1 year 6 months plus a 5000 yuan fine. Someone who sold ticket-snatching software in an online shop paid 20000 yuan for unfair competition.
Cost
No expense and no time required
Benefit
Illegally accessing computer systems or obtaining their data via any technical means can lead to imprisonment…
Bypassing login, token, signature, and similar protections to take data, when circumstances are serious, brings up to 3 years, or 3 to 7 years if especially serious. Crawling personal information is worse. Location tracks, communication content, credit, and property-type information at 50 records already counts as serious circumstances. Accommodation, health, and transaction types at 500 records, other types at 5000 records, or earning 5000 yuan, likewise
Cost
No cost at all. A crawler is simply a program that automat…
Benefit
Taking system data by bypassing protections has the same sentencing range as item 3 (ticket-snatching, flash-s…
If you take a development order knowing it is a gambling app, you are treated as an accomplice in operating a casino. Operating a casino carries up to 5 years, or 5 to 10 years in serious cases — heavier than the at-most 3 years for merely helping. In one e-sports betting app case, 28 people were sentenced under operating a casino to between 1 year and 3 years 6 months. Someone who unblocked QQ accounts for a fraud ring got 1 year 6 months and a 20000 yuan fine.
Cost
No direct monetary cost. The trade-off is forgoing outsour…
Benefit
Providing technical support or payment settlement services to known online criminals can lead to imprisonment…
Account passwords the company gave you do not mean you may still use them after you leave. Illegally controlling a system, when circumstances are serious, brings up to 3 years. Deleting data so the system cannot run, with serious consequences, brings up to 5 years, or 5 years or more if especially serious. An engineer who was dismissed logged in with the old admin account, deleted data and logs, caused over 120000 yuan in losses, and got 3 years suspended for 5 years plus a 30000 yuan fine
Cost
No cost involved. If the employer owes you wages, pursue t…
Benefit
Illegally controlling a computer information system, when circumstances are serious, brings up to 3 years and…
Copyright in code written on the job generally belongs to the company; client lists may also count as trade secrets — taking them is taking the company’s things. A former employee who took security-screening system source code to a new company got 5 years and a 500000 yuan fine; the new company was fined 4000000 yuan. Someone who exploited a system flaw to download over 33000 design files got 1 year 10 months. The company can also sue you separately for damages
Cost
No cost involved. Before leaving, simply delete all compan…
Benefit
Violating confidentiality duties by disclosing trade secrets or using them yourself, when circumstances are se…
Controlling others’ computers, servers, or cameras without permission reaches up to 3 years at 20 devices, or 3 to 7 years if especially serious. Even below the criminal threshold, detention of up to 5 days still applies, and a fine of 50000 to 500000 yuan is possible. Anyone who has received a criminal penalty for this is barred for life from key posts in cybersecurity management and network operations.
Cost
No expense and no time loss
Benefit
Illegally controlling computer information systems is a crime. Serious cases result in up to 3 years in prison…
The statute looks at whether you had authorization and how much you obtained — not at what you meant. Obtaining 500 sets of ordinary account passwords, or earning 5000 yuan or causing the other side 10000 yuan in losses, is enough for up to 3 years. Exporting one user table “to prove the bug” often crosses 500 sets in a single pass. Having account passwords and using them outside the authorized scope also counts as intrusion
Cost
No cost at all. Before joining a vendor’s SRC or public be…
Benefit
Systems of ordinary companies and individuals are computer information systems outside the fields of state aff…
The “Regulations on the Management of Security Vulnerabilities in Network Products” applies not only to companies but also to individuals. There are five strict rules for vulnerability disclosure; the first two state that no details about vulnerabilities affecting active systems may be released before a vendor provides a fix. Additionally, no programs or tools specifically designed to exploit those vulnerabilities may be published, and any release must include instructions on how to remediate them. One often-overlooked rule: unreported vulnerabilities must not be shared with any foreign organizations or individuals outside the vendor.
Cost
No cost involved. Simply report the vulnerability to the p…
Benefit
These regulations govern three main groups: domestic network product vendors, network operators, and any organ…
Any individual or entity that builds their own outbound network connections or uses international channels outside of state-provided public telecom services may be ordered by police to cease internet access, receive a warning, and face fines up to 15,000 yuan plus confiscation of any illegal earnings. Those running businesses based on such services may be charged with illegal business operations; in severe cases, imprisonment of up to five years applies. This rule specifically addresses selling or setting up such nodes. For personal use only, the maximum penalty remains limited to a warning and fine as stipulated in Article 14 of the provisional regulations.
Cost
No expense or time required
Benefit
Direct international internet connectivity must be facilitated via international gateway channels supplied by…
A non-compete clause simply means you’re not allowed to work for a competitor for a certain period after leaving your job. This rule is there to protect you. The maximum duration is 2 years, and the employer must pay compensation every month. If the amount isn’t specified, it’s calculated as 30% of your average monthly wage over the previous 12 months, and it can’t be lower than the local minimum wage. If the employer fails to pay for 3 months due to its own reasons, you can ask to end the agreement. Starting in 2025, workers who never learned about or handled any trade secrets at their job can request that the non-compete clause be ruled invalid.
Cost
The arbitration is free. When you leave your job, keep the…
Benefit
Non-compete clauses only apply to senior executives, highly skilled technicians, and anyone with a duty to kee…
Software written mainly with company equipment, intranet, or business data, for which the company bears responsibility, has copyright belonging to the company; you keep only the right of authorship — and the same if the contract so provides. Code written after hours may still count as the company’s if you used a company computer or business data. Inventions made mainly with company resources also have patents belonging to the company
Cost
No cost involved. When you start a new job, be sure to rea…
Benefit
Works created to complete the unit’s work tasks are works for hire (things made while doing the job). In the o…
Copyright infringement requires you to compensate the copyright holder based on their actual losses or the profits you earned from the infringement. If you commit infringement intentionally and under aggravating circumstances, you may be ordered to pay damages ranging from 1 to 5 times the original amount. One company hired a former employee of a competitor and developed software that was substantially similar to the competitor’s product. The company argued that since the competitor’s software used GPLv2, it was required to be open-source anyway. The Supreme People’s Court ruled that whether a developer complies with GPLv2 or not has no bearing on their copyright rights, and ordered the company to cease infringement and pay 500,000 yuan in damages.
Cost
There is no cost involved. Before using someone else’s ope…
Benefit
Copyright infringement demands compensation based on the rights holder’s actual losses or the infringer’s prof…
Collect only information the business needs; for users under 14 get guardian consent. For violations, first an order to correct; the App may be stopped. Refusal to correct brings a fine of 1000000 yuan or less, and persons in charge 10000 to 100000 yuan. Serious cases bring a fine of 50000000 yuan or less or 5% or less of the prior year’s revenue, and persons in charge 100000 to 1000000 yuan
Cost
No cost involved. Before launch, cross‑check the list of p…
Benefit
Personal data should be processed only for a clear, legitimate purpose that is directly related to that purpos…
Filing costs nothing; domestic servers without filing that refuse to correct will be shut down. Claiming filing is free while actually charging brings a fine of 3 to 5 times illegal gains, or 100000 to 1000000 yuan. Logs must be kept for a full 6 months; refusal to correct or causing consequences brings a fine of 10000 to 100000 yuan
Cost
Filing is free;
Benefit
Commercial internet information services require a license, while non-commercial ones need only registration.…
If you offer generative AI services with public influence or social mobilization potential to the general public, you must perform a safety assessment and register the algorithm per national regulations before launch. Any changes or shutdowns also require filing updates or cancellation paperwork. All generated images and videos must be clearly marked. Tools meant solely for personal use and not open to the public are exempt from these requirements. The regulation itself does not specify penalties; violations are handled under the Cybersecurity Law, Data Security Law, and Personal Information Protection Law.
Cost
No money spent, but you must go through the cyberspace aut…
Benefit
Providing generative artificial-intelligence services with public-opinion attributes or social-mobilization ca…
Making software that skips or blocks ads in other apps for users may get you sued for unfair competition. Not charging money may still count; the law’s “operators” include individuals who provide services. A browser that by default blocked Mango TV’s pre-roll ads paid 800000 yuan. An App that let people jump past Mango TV’s splash ads paid 80000 yuan in losses
Cost
No expense. The cost is giving up a popular little utility…
Benefit
The law prohibits business operators from using technical means to obstruct or disrupt the normal operation of…
An AI relay site is a website that resells foreign large-model APIs at low prices. A Shanghai site operator said he was criminally detained for 37 days for this, is now on bail, will definitely be sentenced, and has already returned illicit gains. The Ministry of State Security has also issued a warning that some relay sites lack operating qualifications and some privately send user data abroad
Cost
No expense. The cost is giving up a low-barrier side busin…
Benefit
In June (6) 2026 the Ministry of State Security issued a risk warning. It said AI relay sites are a proxy laye…
Registration-code checks, dongles, and similar verification are a software’s technical measures; bypassing them without permission is infringement, and you must pay even if you charge nothing. Cracking or selling crack tools for profit — earning 30000 yuan or selling 50000 yuan — is enough for a criminal sentence, up to 10 years. Someone who made cracked dongles paired with pirated software for sale saw three co-defendants get between 1 year and 3 years 2 months
Cost
No money spent. The trade-off is dropping fast money from…
Benefit
Civil side first. The Copyright Law allows rights holders to add technical measures to works. Technical measur…
Using DDoS so others’ websites, servers, or games cannot open is the crime of destroying a computer information system. Serious consequences bring up to 5 years; especially serious consequences bring 5 years or more. People who pay a platform to attack are also joint offenders. Someone who ran a DDoS site collecting membership fees and taking orders got between 10 months and 5 years 6 months
Cost
No money spent. DDoS means controlling many machines to se…
Benefit
Interfering with the functions of a computer information system so it cannot run normally, with serious conseq…
