Only collect personal data strictly necessary for the app’s operation; consent from guardians is required for users under 14, and the privacy policy must be clearly written

No cost involved. Before launch, cross‑check the list of permissions the app requests against the privacy policy and remove any unnecessary permissions. The main challenge is that product teams often want to retain data “just in case it might be useful later.”

Personal data should be processed only for a clear, legitimate purpose that is directly related to that purpose, using methods that minimize impact on individuals’ rights. Consent from the individual is required unless another legal basis applies. For users under 14, consent from parents or guardians is mandatory. Violations lead to regulatory orders to correct the problem, warnings, and confiscation of illegal earnings; the offending app may be suspended or shut down. Persistent breaches incur fines up to 1 million RMB, while responsible managers and staff may be fined between 10,000 and 100,000 RMB. In extreme cases, fines can exceed 50 million RMB or 5 % of annual revenue, and those individuals may be barred from serving as directors, supervisors, or executives of related companies. Criminal acts involving the sale or disclosure of personal data are covered under Section 4 (National). Before processing, users must be prominently informed in clear, understandable language of the processor’s identity and contact details, the types of information collected, purposes and methods of processing, retention period, and how to exercise their rights. If notice is given through processing rules, commonly called a privacy policy, those rules must be public and easy to consult and save.

全国人大常委会 (2021). 个人信息保护法（第六、十三、三十一、六十六条）. http://www.npc.gov.cn/npc/c2/c30834/202108/t20210820_313088.html；全国人大常委会 (2021). 个人信息保护法（第十七条：「个人信息处理者在处理个人信息前，应当以显著方式、清晰易懂的语言真实、准确、完整地向个人告知下列事项」；「个人信息处理者通过制定个人信息处理规则的方式告知第一款规定事项的，处理规则应当公开，并且便于查阅和保存」）. http://www.npc.gov.cn/npc/c2/c30834/202108/t20210820_313088.html

The statute does not say which posts count as “other persons directly responsible.” The author infers that people who write code and build the product may also be counted; this book found no case that can be checked word for word. MIIT periodically announces Apps taken down for violations; this section did not verify which specific bulletin, so none is cited.