Beijing’s tough new law on personal information protection will make Chinese tech giants “a lot less powerful” and force many businesses to adapt as it will be much harder to legally collect and use consumer data, experts say.

China’s legislature passed the Personal Information Protection Law (PIPL) last Friday - one of the strictest in the world for personal data security - imposing significant legal restrictions on how personal data can be collected, used and managed. The law, which is being compared to the European Union’s General Data Protection Regulation (GDPR) in terms of scope and impact, comes into effect on November 1.

The PIPL, along with China’s Data Security Law that comes into effect next week, will form a rigid legal framework for the country’s Big Tech companies to comply with, putting an end to their freewheeling, data-driven business expansion and throwing some existing profit models into question, analysts said.

“Tech companies will be a lot less powerful. [User data collection] is not going to be a free-for-all any more,” said Doug Clark, global head of dispute resolution at Rouse & Co and adjunct professor of law at the University of Hong Kong.

The passing of the PIPL comes amid China’s unprecedented crackdown on the country’s tech sector, which kicked off with an antitrust drive earlier this year. In recent months, authorities have unleashed a slew of new regulations to rein in Big Tech, including consumer rights and the protection of minors, among others, triggering a US$1.5 trillion sell-off on bourses in mainland China, Hong Kong and the US, leaving investors guessing as to what comes next.

Given how strictly Beijing has enforced these other new laws, Chinese tech companies should scrutinise their data protection practices very closely or risk being the next high-profile target, said Kenn Yee, an analyst at Access Partnership.

Yee also warned that foreign firms are exposed to the regulatory risk, as the PIPL applies to any company that processes the personal information of anyone in China – similar to the GDPR - even if they operate outside China.

Clark said any company that relies on data to “up sell you, sell your data to others for advertising, or provide advertising services” will have to change their business model, adding that companies in the data analytics, e-commerce, advertising, online content and online service industries is likely to sustain the biggest impact from the PIPL.

Angela Zhang, a law professor at the University of Hong Kong, said large online platforms that are deemed gatekeepers will see an immediate impact, with the restrictions on personalised content recommendations and marketing forcing many to change the way they do business.

“The recommendation system lies at the core of the business strategy for many online platforms these days, and the requirement to provide an opt-out from such personalised services could have the impact of reducing such targeted content and advertising,” she said.

A driver opens the Didi Chuxing app on his smartphone in Beijing, in July 2021.

You Yunting, senior partner at Shanghai Debund Law Firm, said internet companies will face “grave consequences” if they fail to comply with the new regulations. “When Alibaba was penalised for breaching the antitrust law, the fine was 4 per cent of its total China sales at 455.7 billion yuan (US$70 billion),” You said. “But PIPL’s maximum penalty is 5 per cent.”

The ban on algorithmic price discrimination is a key aspect that has stood out to experts. According to the law, if personal information is used in automated decision-making, the process has to be transparent and different individuals cannot be subject to different transaction terms.

In practice, that means platforms cannot show different consumers different prices based on the algorithm’s assumptions regarding the user’s intention and ability to pay.

“[This ban] directly affects the surplus that platforms can extract from consumers, so it will have a direct impact on profits,” Zhang said.

This rule will have a huge impact on China’s ride-hailing platforms like Didi Chuxing because “they use algorithms to evaluate drivers and determine what they charge customers”, according to You.

He said platforms that lure new users with a lower rate but exploit returning customers with higher rates will face scrutiny by regulators and potential judicial lawsuits after the PIPL comes into force.

Also, if drivers feel they have been unfairly treated as a result of decisions by the algorithms, they can demand that platforms disclose the algorithms and decide if they will accept the evaluation.

Clark said the law will also make it more difficult for companies to share data across borders, and is likely to hurt service industries that use online data. Citing the hospitality industry as an example, he said, “Luxury hotels may not want to make sure that the room is set up how you like it, or if you have certain things that you want done [before checking in].”

However, some believe the new law could create new trends for the tech sector as the old practices become prohibited. Since precise targeting enabled by data analytics will become more difficult, Clark expects companies to lean more heavily on the use of influencers to market their products.