China's Cyberspace Administration (CAC)

Establishment and Powers

The Cyberspace Administration of China (CAC) (Wangluo Xinxi Bangongshi, 网络信息办公室) was established in February 2014 as the principal internet regulatory authority. The CAC was created by merging the functions of the State Internet Information Office (SIIO), which had been established in 2011 under the State Council Information Office, and consolidating internet content regulation functions from the Ministry of Industry and Information Technology (MIIT), the Ministry of Public Security (MPS), and the General Administration of Press and Publication.

The CAC is both a Party and a state organ, functioning as the office of the Central Cyberspace Affairs Commission (Zhongyang Wangluo Anquan he Xinxi Hua Weiyuanhui), the Party’s highest internet governance body chaired by Xi Jinping. The dual structure — Party commission and state administration — gives the CAC unmatched regulatory authority, spanning content regulation, cybersecurity, data governance, and internet infrastructure.

The CAC’s powers include: drafting internet laws, regulations, and policies; approving internet news and information services; regulating online content; directing internet censorship; conducting cybersecurity reviews; enforcing personal information protection; regulating data cross-border transfers; and coordinating with other agencies on internet governance.

Wangxinban Enforcement

The CAC’s enforcement operations, known as wangxinban (网信办), have expanded dramatically since 2014. The CAC conducts regular “special campaigns” (zhuanxiang zhengzhi) targeting specific categories of content, including: rumours and disinformation; vulgar and pornographic content; political content deemed harmful to national security; content related to “false” COVID-19 information (2020-2022); and content related to “financial irregularities and illegal securities activities” (2021-2023).

The CAC’s enforcement powers under the Cybersecurity Law (2017) and the Personal Information Protection Law (2021) include: requiring platforms to remove specified content within a prescribed time (typically 24 hours); directing platforms to suspend or terminate services for content violations; ordering platforms to rectify data processing practices; requiring platforms to undergo security reviews for new products or services; imposing administrative fines (up to RMB 50 million for serious violations or 5% of annual turnover); and referring cases for criminal prosecution.

Internet Content Management

Internet content management in China operates through a platform accountability system. The CAC requires internet platforms — including WeChat, Weibo, Douyin (TikTok), Baidu, and Tencent — to exercise “primary responsibility” (zhuti zeren) over content published on their platforms. Platforms must maintain content review teams that review all content for compliance with the CAC’s content standards before publication or within a short period after publication.

The content standards are established by the CAC’s Provisions on the Management of Internet Information Services (2000, revised 2021) and supplemented by industry-specific regulations covering news, audio-video programs, live streaming, gaming, and instant messaging. The prohibited content categories under Article 12 of the Cybersecurity Law include content that: opposes the fundamental principles of the Constitution; endangers national security; incites ethnic hatred or ethnic discrimination; spreads rumours disrupting social order; promotes pornography, gambling, or violence; incites illegal assembly or association; or violates the lawful rights and interests of others.

Removal Orders

The CAC has the authority to issue removal orders (chechu hou), requiring platforms to remove specified content. The removal orders are issued as administrative directives and are not subject to prior judicial approval. Platforms that fail to comply with removal orders face fines and potential suspension of operations.

The CAC also uses the Article 320 era framework — referencing Article 320 of the Cybersecurity Law, which requires platforms to report cybersecurity incidents to the CAC “without delay” — to compel the removal of content that the CAC considers to be “security incidents.”

The number of removal orders issued by the CAC is not publicly disclosed, but external studies estimate that the CAC orders the removal of hundreds of thousands of pieces of content annually. The removal orders cover political content (criticism of the Party, government, or leaders), social content (discussions of protest, censorship, or human rights), and commercial content (defamation, intellectual property infringement).

Platform Accountability

Platform accountability under the CAC’s regulatory framework requires platforms to maintain: content review departments with adequately trained staff operating 24/7; user registration systems that identify all users through real-name registration (shiming zhi); complaint and reporting mechanisms that allow users to report prohibited content; data storage and reporting obligations (platforms must retain records of content publication and deletion for at least six months and must provide data to the CAC on request); and algorithmic transparency obligations (platforms must explain the content recommendation algorithms and must disable algorithmic recommendations for certain categories of content).

The accountability system was strengthened by the Provisions on the Regulation of Algorithmic Recommendations in Internet Information Services (2022), which require platforms to register their algorithms with the CAC, to assess algorithms for compliance with content standards, and to provide users with the option to disable algorithmic recommendations.

Weibo/WeChat Regulation

The CAC’s regulation of Weibo (microblogging platform) and WeChat (social media/instant messaging platform) has been particularly intensive. Both platforms are subject to the general content regulation framework and to platform-specific regulations.

WeChat is regulated under the Provisions on the Management of Instant Messaging Services (2012, revised 2022), which require the platform to monitor chat content for prohibited material, to implement real-name registration, and to limit the functionality of WeChat groups (including group size limits and content moderation requirements for group administrators). The 2022 revision required WeChat to scan all messages for “illegal and harmful information” using automated content review technology.

Weibo is regulated under the Provisions on the Management of Microblogging Services (2014, revised 2022), which require platforms to maintain a “hot topic” review system (ensuring that trending topics do not include prohibited content), to verify the identity of accounts with more than 50,000 followers, and to sanction accounts that spread “false information.”

Deep Draft Implementation

The “Deep Draft” (Shen Du) refers to the 2018 Provisions on the Management of Internet Information Services for Deep Learning and Algorithmic Recommendation Technology, which require platforms that use algorithmic recommendation technology to register with the CAC, to conduct algorithmic fairness assessments, and to provide users with the option to disable personalised recommendations.

The Deep Draft implementation, effective 2022, required all platforms using algorithmic recommendation to: file detailed descriptions of their algorithms with the CAC; conduct annual fairness assessments (evaluating the algorithm’s impact on content diversity, political risk, and user rights); provide users with an “opt-out” button for personalised recommendations; and publish the basic principles of the algorithm’s operation.

Conclusion

The CAC has emerged as one of the most powerful regulatory bodies in the Chinese state, exercising comprehensive authority over internet content, cybersecurity, data governance, and platform regulation. The dual Party-state structure gives the CAC unmatched coercive capacity. The platform accountability system, removal orders, and user real-name registration have created a system of pervasive internet content regulation that substantially limits the space for political expression, social criticism, and dissenting opinion while maintaining the appearance of a functioning commercial internet ecosystem.