26 Building a website or platform: licenses, filing, and servers

According to regulations, a payment business is defined as “transferring monetary funds based on electronic payment instructions submitted by payers or payees.” In other words, it involves moving money on behalf of others per their instructions. To operate such a business, one must obtain a payment license from the People’s Bank of China, and the minimum registered capital must be 100,000,000 yuan, and that 100,000,000 yuan must actually be paid into the company account. Unauthorized operation results in immediate closure and seizure of all profits. If illegal gains are 500,000 yuan or more, an additional fine of 1 to 5 times that amount is imposed. If there are no illegal gains or they are under 500,000 yuan, the fine is 500000 to 2,000,000 yuan; additionally, a further fine of 100,000 to 500,000 RMB applies to legal representatives and responsible personnel. Criminal law also classifies “illegally conducting fund payment and settlement services” as illegal business activity; serious violations may lead to imprisonment of up to five years, while especially grave cases incur sentences exceeding five years. An interpretation by the Supreme People’s Court and Supreme People’s Procuratorate draws the line for “serious”: an illegal business amount of 5 million yuan or more, or illegal gains of 100,000 yuan or more (nationwide, from May 2024).

The regulation says: "The state implements a licensing system for commercial internet information services, and a filing system for non-commercial internet information services. Without a license, or without completing the filing, internet information services may not be provided." A site that charges has to get the license first. A site that does not charge has to file first. Without either of the 2, the site cannot open. What counts as commercial? The regulation says it is "providing information, web-page production, or similar services to internet users for a fee through the internet." In short, charging the user. The kind that matches a trade is called online data processing and transaction processing. In the trade it is shortened to EDI. The regulation defines it as "using data and transaction or business-processing application platforms connected to the public communications network or the internet, to provide users with online data processing and transaction or business processing through the public communications network or the internet." It also "includes transaction-processing services, electronic data interchange services, and network or electronic-device data-processing services." That means the website processes data online for the user, or matches both sides of a sale and processes the transaction. Operating without the license, or operating beyond its scope, means the illegal gains are confiscated, and a fine of 3 to 5 times the illegal gains is added. Operating beyond the scope means you have the license, but what you do goes past what the license writes. If there are no illegal gains, or the illegal gains are under 50,000 yuan, the fine is 100000 to 1,000,000 yuan. In a serious case, the website is ordered closed (nationwide). Charging money does not always mean you must get the license. A question-and-answer issued by the Guangdong Communications Administration in October 2025 says that, under a requirement of the Ministry of Industry and Information Technology, the 3 cases below do not need this license. Case 1: a company, on its own website or app, "directly sells its own goods or services, or those of another company, in a self-operated way," and no other unit or individual opens a shop there. Case 2: a company posts only its own information on its own website or app, and does not provide other people with a platform for posting information. Case 3: a company does business only through mini programs, official accounts, video accounts, or online shops on platforms such as WeChat and Alipay, "and has no other independently operated platform." The other way around: as soon as you let others open a shop, or let users post information here, you are outside these 3 cases.

A unit that does online performance has to get the license first. The regulation says it "shall, under the Interim Provisions on the Administration of Internet Culture, apply to the provincial culture department for an Online Cultural Business License, and the business scope of the license shall expressly include online performance." Playing a game for people to watch, or explaining it to them, is handled under the same set of rules. The regulation says it is "administered by reference to these measures." Video records of all online performances "shall be kept for no less than 60 days." You keep videos you have streamed for a full 60 days yourself. Doing commercial internet cultural activities without approval brings an order to stop, a warning, and a fine of up to 30,000 yuan. If you are told to stop and you still do not, you are put on the cultural-market blacklist. Putting programs online is a different permit. You "shall obtain a Permit for Disseminating Audiovisual Programs over Information Networks." The applicant must "have the status of a legal person, and be a wholly state-owned or state-controlled unit." It has to be a unit wholly owned by the state or controlled by the state. A private company basically cannot get it. Doing it without this permit brings a warning and an order to correct, and a fine of up to 30,000 yuan may be added. In a serious case, the penalty follows the regulations on radio and television administration (nationwide).

The regulation says: "Without filing, non-commercial internet information services may not be provided inside the People's Republic of China." A website that does not charge users still has to file first, as long as it is placed inside China. Without filing, you are ordered to correct within a time limit, and fined 10,000 yuan. If you refuse to correct, the website is closed. The provider that connects your server to the network is also regulated. It "may not provide internet access services for an organization or an individual that has not filed and that engages in non-commercial internet information services." A provider that collects money for you is the same. The regulation says this kind of provider "may not provide access, collection of fees on behalf of others, or similar services to a unit or an individual that has not lawfully obtained an operating license or completed the filing for non-commercial internet information services." That means a regular provider is not allowed to connect a site that has neither a license nor a filing. Also, colocation and a cloud server are called internet data center services in the regulation, and broadband access is called an internet access service. These 2 themselves require a license. The provider has to hold the license first. If the website homepage does not show the filing number, you are ordered to correct, and fined 5000 to 50,000 yuan. From September 2023, apps and mini programs also have to be filed. A notice from the Ministry of Industry and Information Technology says that the sponsor of an app providing services inside China "may not engage in app internet information services if the filing has not been completed." Distribution platforms include mini-program platforms. The notice requires app stores, mini-program platforms, and phone makers "not to provide network access, distribution, pre-installation, or similar services for an app that has not completed the filing." Once a provincial communications administration receives complete and accurate materials, it "shall complete the filing within 20 working days." The filing number has to be shown in a prominent place in the app. The Anti-Telecom and Online Fraud Law also states that setting up an app "shall go through licensing or filing with the telecommunications authority in accordance with the relevant state provisions" (nationwide).

Legal regulations set specific obligations for platforms. The official wording states that platforms must require sellers to provide authentic identity, address, contact, and licensing information, then verify and register this data while maintaining updated records. This means sellers must submit their basic details and required permits before joining, which you must then confirm and log into a database. Periodic re-verification is also mandatory. The exact interval for re-verification is defined as “at least every six months” under relevant administrative rules. Additionally, you must submit seller identity data to market regulators, and submit seller identity data and tax-related information to the tax authorities, as required by tax administration laws. All product, service, and transaction data must be retained for no less than three years from the date each transaction concludes. Non-compliance triggers a rectification order; persistent violations incur fines of 20,000–100,000 yuan, while severe cases may lead to temporary suspension of operations and fines of 100,000–500,000 yuan. Tax reports must be submitted within the month following each quarter’s end, with identical penalties for late submissions nationwide.

The regulation says the platform "shall fulfill the primary responsibility for managing information content." What users post is for the platform itself to manage. In particular it must "improve the systems for user registration, account management, review of published information, review of comments and replies, ecological management of pages, real-time patrol, emergency handling, and handling of online rumors and of information from black-market chains." From registration, posts, and comments, through the daily patrol and handling when something happens, every link needs a rule written down. It also "shall set a convenient complaint and report entry in a prominent position." The report button has to sit where a user can see it at a glance and can tap it. On finding illegal information, it "shall immediately take handling measures according to law, keep the relevant records, and report to the relevant authority." The Cybersecurity Law is more specific. It says: "On finding information whose publication or transmission is prohibited by laws or administrative regulations, it shall immediately stop transmission of that information, take handling measures such as removal, prevent the information from spreading, keep the relevant records, and report to the relevant authority." If this is not done, you are ordered to correct, given a warning, and given a circulated notice, and a fine of 50000 to 500,000 yuan may be added. If you refuse to correct, or the case is serious, the fine is 500000 to 2,000,000 yuan. You may also be ordered to suspend business for rectification, to close the website or the application, or to have the license or the business license revoked. The person directly in charge is fined another 50000 to 200,000 yuan (nationwide).

The law says: "Where a network operator handles network access or domain-name registration for a user, handles network-entry procedures for a fixed telephone, a mobile telephone, or the like, or provides the user with services such as information publishing or instant messaging, it shall, when signing an agreement with the user or confirming that the service will be provided, require the user to provide real identity information. If the user does not provide real identity information, the network operator may not provide the relevant service." If you did not ask for a real name, or the user did not give a real identity and you still let them use it, you are ordered to correct. If you refuse to correct, or the case is serious, the fine is 50000 to 500,000 yuan. You may also be ordered to suspend the relevant business, to suspend business for rectification, to close the website or the application, or to have the license or the business license revoked. The person directly in charge is fined another 10000 to 100,000 yuan. Live-stream services follow the principle of "real name in the back, voluntary on the front," and do "authentication of real identity information based on a mobile telephone number or a similar method." That means the platform's back end stores the user's real name, the nickname shown on the page is chosen by the user, and the check uses something like a mobile number. Live-stream selling is stricter. It is "authentication of real identity information based on identity-document information, the unified social credit code, and the like." The unified social credit code is the string of numbers on the business license (nationwide).

The law clearly states that “online live streaming service providers must not offer account registration services to minors under 16; when providing such services to minors aged 16 or older, they must verify their identity and obtain consent from a parent or other guardian.” It also mandates “a dynamic verification mechanism for the real identity information of live streamers,” meaning platforms must be able to recheck a streamer’s identity at any time. Additionally, platforms must “reasonably limit the maximum amount a minor may spend per transaction and per day,” establishing spending caps based on age. Tipping rules are similarly tiered: “Tipping services must not be offered to minors under 8; for those aged 8–16, consent from a guardian is required; for those 16 or older, consent or proof of income is required.” Finally, if a minor lacking full legal capacity tips without guardian approval and the guardian asks for the money back, the court should support it. Minors lacking full legal capacity are those who cannot yet fully decide for themselves under the law (nationwide).

The rights holder "has the right to notify the e-commerce platform operator to take necessary measures such as deletion, blocking, disconnecting a link, and ending the transaction and the service. The notice shall include preliminary evidence that infringement is made out." The rights holder is the owner of a right such as a trademark, a copyright, or a patent. Sending 1 sentence does not count. Preliminary evidence has to be attached. After the platform receives the notice, it "shall take the necessary measures in time, and forward that notice to the operator on the platform. If it does not take the necessary measures in time, it bears joint and several liability with the operator on the platform for the enlarged part of the harm." If you drag and do not handle it, you and the seller pay together for the extra part of the loss. After the seller objects, the platform "shall promptly end the measures it took if, within 15 days after the forwarded statement reaches the intellectual-property rights holder, it has not received notice that the rights holder has complained or sued." That means you forward the seller's objection to the rights holder and wait 15 days. If the other side has neither complained nor sued, you restore what was deleted or taken down. If the platform knows, or ought to know, of infringement and does not handle it, it bears joint and several liability with the infringer. The intellectual-property department can also order you to correct within a time limit. If you do not correct in time, the fine is 50000 to 500,000 yuan, and in a serious case 500000 to 2,000,000 yuan. The other way around: "A person who maliciously sends a wrong notice and causes loss to an operator on the platform bears double the liability for compensation" (nationwide).

To lawfully provide personal information to overseas entities — whether to foreign companies or foreign servers — at least one of four conditions must be met: passing a security assessment by the Cyberspace Administration; obtaining personal information protection certification; signing a standard contract drafted by the Cyberspace Administration; or meeting other requirements set by laws or administrative regulations. Additionally, you must inform users of the overseas recipient’s name, contact details, processing purpose, methods, and types of data involved, and how they can exercise their rights, and obtain their separate consent. Threshold limits apply based on cumulative user counts. For most businesses not classified as critical information infrastructure operators, the exemption threshold is “personal information of fewer than 100,000 people (excluding sensitive personal information) provided overseas, cumulatively since 1 January of that year.” Below this threshold, no assessment, contract, or certification is required. For 100,000 people or more but under 1,000,000, a standard contract or certification is mandatory. For 1,000,000 people or more, or when sensitive personal information of 10,000 people or more is involved, a formal security assessment is required (effective nationwide since March 2024).

The difference among the 3 tiers is not the price. It is what you have in hand on the day something goes wrong. A mainstream cloud vendor has a filing channel, the qualifications are public, a failure comes with a notice, the contract has a compensation clause, and when something goes wrong you can find a person. A small provider's price can be half as much, but when it oversells, disappears, or gets cut off by the upstream, you have nobody to appeal to. So before you talk price, check in the Ministry of Industry and Information Technology system whether it holds a value-added telecommunications business license. Colocation of a dedicated server pays only when 2 conditions both hold: the bandwidth or the hardware is clearly cheaper, and you have your own people to run it. How to choose: a static site with no user data is enough on the cheapest VPS. If there is user registration and there are transactions, choose a cloud server that can scale and can take snapshot backups, and keep the backups in at least 2 places.

The Personal Information Protection Law says: "Where a leak, alteration, or loss of personal information occurs or may occur, the personal-information handler shall immediately take remedial measures, and notify the department performing personal-information protection duties and the individuals." The notice has to write 3 things: which kind of information leaked, the cause, and the harm that may follow; what remedy you took, and what the user can do to reduce the harm; and your contact details. If your remedy really can avoid the harm, you may skip notifying the user. But if the authority believes harm may result, it has the right to require you to notify. The Regulations on the Administration of Network Data Security say the notice may use "a telephone call, a text message, an instant-messaging tool, email, or a public announcement." If while handling it you find a lead that a crime may be involved, report it to the public security organ and the state security organ. If you do not perform these duties, you are ordered to correct, warned, and the illegal gains are confiscated, and an app that broke the rule can be ordered to suspend or end the service. If you refuse to correct, the fine is up to 1,000,000 yuan, and the person directly in charge is fined 10000 to 100,000 yuan. In a serious case, the fine is up to 50,000,000 yuan or up to 5% of the previous year's turnover, and the person in charge is fined 100000 to 1,000,000 yuan. On the civil side, if a user is harmed by this, you "shall bear tort liability such as damages if you cannot prove that you were not at fault." A leak on a large scale also has to be reported on time. The measures of the Cyberspace Administration of China provide that a leak of personal information of 1000000 or more people counts as a "fairly large cybersecurity incident." For this kind of incident, an ordinary website or app reports to the cyberspace department of the province where it is, "no later than 4 hours," and a channel for it is the 12387 hotline. Within 30 days after the handling ends, you also submit a summary report. Late reporting, omitted reporting, false reporting, or concealed reporting that causes a serious harmful result is punished more heavily. The other way around: if reasonable and necessary protection was already in place, the case was handled under the plan, and it was reported in time, "it may be treated more lightly, or not pursued, depending on the circumstances" (nationwide, the reporting measures from November 2025).

The Measures for the Supervision and Administration of Online Transactions say that, where a service is provided by automatic extension, automatic renewal, or a similar method, you "shall, before the consumer accepts the service and before the date of the automatic extension, automatic renewal, or similar step, draw the consumer's attention in a prominent way, and leave the choice to the consumer." During the service you must also "provide the consumer with a prominent and simple option to cancel or change at any time, and must not charge an unreasonable fee." The regulations implementing the Law on the Protection of Consumer Rights and Interests have the same reminder requirement. If the reminder is not given, the penalty follows those implementing regulations: an order to correct, and a warning, confiscation of the illegal gains, and a fine of 1 to 5 times the illegal gains are allowed. If there are no illegal gains, the fine is up to 300,000 yuan. In a serious case, you are ordered to suspend business for rectification, and the business license is revoked. If you do not give a convenient cancel entry, you are ordered to correct within a time limit, and a fine of up to 30,000 yuan is allowed (nationwide).