Internet Information Service Algorithmic Recommendation Management Provisions

· About Internet Information Service Algorithmic Recommendation Management Provisions

Key Takeaways

  • The Internet Information Service Algorithmic Recommendation Management Provisions apply to providers of algorithmic recommendation services in China’s internet information services sector and took effect on 1 March 2022.[7][11]
  • Providers must disclose that algorithmic recommendation services are being used, explain the basic principles and main operating mechanisms, and give users a convenient way to opt out or receive non-personalized recommendations.[5][8]
  • Providers with public opinion attributes or social mobilization capabilities must complete a filing with the Cyberspace Administration of China (CAC), including information such as the service form, algorithm type, and self-assessment report.[12]
  • The rules prohibit practices that endanger national security, undermine social order, or use algorithms to engage in discriminatory pricing, illegal interference, or other conduct that harms users’ rights and interests.[2][11]
  • The text remains a binding departmental rule in force as of 2026, and the sources reviewed do not show a published 2025–2026 amendment or a formal delay to the 2022 effective date.[2][4][7]
  • Violations may trigger correction orders, warnings, administrative penalties under China’s Cybersecurity Law, Data Security Law, Personal Information Protection Law, and related rules, and public-security or market-regulation consequences depending on the conduct.[2][11]

What It Is

The Provisions on the Administration of Algorithmic Recommendation for Internet Information Services regulate recommendation-algorithm use by internet information service providers in China and are enforced by the Cyberspace Administration of China (CAC) together with other relevant regulators.[2][4][7] They were adopted on 16 November 2021 and entered into force on 1 March 2022.[2][7]

The rules are designed to govern algorithmic recommendation technologies used to push, select, rank, filter, or otherwise personalize information, including systems with generation, synthesis, and similar recommendation functions.[5][15] They sit within China’s broader algorithm governance framework and are treated as a binding departmental rule rather than a draft or soft-law guideline.[4][11]

No primary source reviewed here shows a 2025 or 2026 amendment changing the effective date or postponing enforcement; the current public summaries still describe the same 2022 commencement.[2][7][11]

Who Must Comply

The provisions apply to entities that provide internet information services using algorithmic recommendation technology within China, including services that personalize content delivery, ranking, or selection for users in the PRC.[5][8][11] Several secondary analyses describe the reach broadly, covering both domestic and foreign providers if the service is offered to users in China.[3][8][11]

A key threshold is whether the provider has public opinion attributes or social mobilization capabilities; those providers face CAC filing obligations and enhanced governance expectations.[12] The rules also distinguish services based on risk and influence, using a classification-and-hierarchy approach that is echoed in market analyses.[1][4][13]

The provisions do not create a broad exemption for foreign companies merely because they lack an entity in China; the operative question is whether the recommendation service is provided to users in China.[5][11][14] Specific exemptions are not prominently set out in the summaries reviewed, and companies should assume the rules apply unless a narrower service-specific exception is confirmed in the text.[2][7]

Core Requirements

  1. Transparency notice — Providers must clearly notify users that algorithmic recommendation services are being used and disclose the basic principles, intended purpose, and main operating mechanism of the service.[5][8]
  1. User choice and opt-out — Providers must offer users a convenient option to turn off algorithmic recommendation services or to receive recommendations not based on their personal characteristics.[8][10][13]
  1. Filing for influential services — Providers with public opinion attributes or social mobilization capabilities must file with the CAC and provide the service provider’s name, service form, application field, algorithm type, and self-assessment materials.[12]
  1. Fairness and non-discrimination — Providers must not use algorithms to impose discriminatory pricing or other unfair treatment based on user characteristics, and they must avoid conduct that infringes legitimate user rights and interests.[2][11][15]
  1. Content and security governance — Providers must establish management systems and technical measures to prevent dissemination of illegal information and to ensure algorithm use does not endanger national security, social order, or public interests.[2][13]
  1. Special protections for vulnerable users — The framework requires heightened safeguards for minors and other protected users, including limits on harmful content and manipulative recommendation practices.[3][6][12]
  1. Accountability and review — Providers are expected to conduct ongoing governance, testing, and assessment of algorithm systems, including internal reviews and corrective action when risks are identified.[2][4][12]

Deadlines and Penalties

| milestone | date | what applies | |---|---:|---| | Adoption by CAC and co-issuing agencies | 16 November 2021 | The final text was adopted and released as a binding departmental rule.[2][7] | | Entry into force | 1 March 2022 | Compliance obligations became enforceable.[2][7] | | Filing for higher-impact services | from 1 March 2022 onward | Providers with public opinion attributes or social mobilization capabilities must complete CAC filing.[12] | | Ongoing compliance | continuous | Providers must maintain notices, opt-out functions, and governance controls throughout operation.[5][8][13] |

Maximum sanctions are not contained in a single penalty schedule inside the provisions summary, but the rule expressly contemplates administrative action and cross-references enforcement under China’s cybersecurity and data laws.[2][11] In practice, consequences can include orders to correct, warnings, service suspension or rectification measures, and penalties under the Cybersecurity Law, Data Security Law, Personal Information Protection Law, and related administrative rules depending on the violation.[11][12] For serious violations involving illegal content, discriminatory practices, or personal information issues, companies may also face sectoral enforcement and reputational consequences in addition to regulatory fines.[2][11]

How to Comply

  1. Map every recommendation use case — Inventory all ranking, selection, personalization, and feed-ranking functions that reach users in China, including vendor-built and embedded features.
  1. Classify the service risk profile — Determine whether the service has public opinion attributes or social mobilization capabilities, since that drives filing, governance, and review obligations.[12]
  1. Build a transparency and consent workflow — Implement user notices that plainly identify recommendation use, explain the basic mechanism, and offer a simple opt-out or non-personalized alternative.[5][8]
  1. Create algorithm governance controls — Establish documented policies for model change control, content safety, discriminatory pricing checks, incident escalation, and periodic internal assessment; these controls map well to ISO 27001 for security governance and NIST CSF 2.0 for risk management.[2][11]
  1. Add AI governance management — Use ISO 42001 to structure AI-specific policies, roles, impact assessment, monitoring, and corrective action, especially where recommendation systems are continuously updated.
  1. Prepare filing dossiers early — For higher-impact services, maintain the required service description, algorithm category, and self-assessment evidence in a form ready for CAC filing.[12]
  1. Test vulnerable-user protections — Review settings for minors, elderly users, and other sensitive populations to ensure recommendations do not amplify harmful content or exploit behavioral vulnerabilities.[3][12]
  1. Monitor changes in Chinese law — Reassess obligations when related rules on deep synthesis, generative AI, personal information, or content moderation change, because algorithmic recommendation compliance is not isolated from the wider PRC digital-regulation regime.[6][11]

Related Regulations

  • Cybersecurity Law of the PRC — This law supplies general network-security duties and enforcement mechanisms that can be used when algorithmic recommendation practices create cybersecurity or content risks.[11]
  • Personal Information Protection Law (PIPL) — Recommendation systems that profile users or infer personal characteristics must align with PIPL rules on personal information processing, profiling, and automated decision-making.[11]
  • Data Security Law — Data-handling practices for algorithm training, evaluation, and recommendation operations must respect data-classification and security obligations.[11]
  • Administrative Provisions on Deep Synthesis in Internet-Based Information Services — These rules overlap where generative or synthetic content is combined with recommendation functions and shared notice, labeling, and security duties apply.[6]
  • Interim Measures for the Management of Generative AI Services — These measures may overlap where recommendation systems are part of a broader generative AI service stack, especially on content safety and provider responsibility.[3][6]

FAQ

Does this apply to companies outside China?

Yes, if the company provides algorithmic recommendation services to users in China, the practical analysis points to application regardless of where the company is headquartered.[5][8][11] Secondary sources consistently describe the rule as covering services made available in the PRC. Companies without a Chinese entity should still assess local enforcement risk and filing exposure.[3][14]

Do users have the right to turn off recommendations?

Yes. The provisions require a convenient option to switch off algorithmic recommendation services or receive recommendations that are not based on personal characteristics.[8][10][13] The opt-out must be usable in practice, not hidden in technical settings that users cannot reasonably find.[5][8]

What services must file with CAC?

Providers with public opinion attributes or social mobilization capabilities must complete filing with the CAC.[12] The filing package includes the service provider’s name, service form, application field, algorithm type, and an algorithm self-assessment report or similar materials.[12]

Are there special rules for minors?

Yes. The framework requires strengthened protection for minors and limits harmful content and manipulative recommendation behavior.[3][12] Providers should treat age-sensitive recommendation flows as a compliance priority and test them separately from general-user settings.[3][6]

Were there any 2025–2026 amendments or delays?

No published amendment or formal delay was identified in the sources reviewed here, and the currently cited public summaries still describe the original 1 March 2022 effective date.[2][7][11] If a company is relying on an unpublished internal notice or local implementation practice, it should verify that against the official CAC text before treating it as law.

Sources

Put it into practice

More compliance guides