China Introduces National Cyber ID Amid Privacy Concerns

By Robert Lemos, Contributing Writer

Originally published by DARK READING on July 23, 2025

China officially rolled out a voluntary Internet identity system to protect citizens’ online identities and personal information, but critics worry about privacy and surveillance.

China’s national online ID service went into affect earlier this month, promising to increase user privacy by reducing the amount of data collected by private-sector companies, but privacy and digital rights activists continued to criticize the measures as increasing government control over citizens’ online lives.

Known as the National Online Identity Authentication Public Service, the government-controlled digital identity system will allow citizens to register by providing official government documents and then will shield their information from Internet services, reducing the overall information footprint. The service is currently voluntary for users, but mandatory for companies, which must not collect identity information from people using the service unless otherwise required by law.

On its face, the regulations give Internet users a centralized repository for their identity data, held by the government, and to prevent the inconsistent handling by private companies, says Kendra Schaefer, a partner at Beijing-based policy consultancy Trivium China.

“Basically, they’re just switching the holder of data,” she says. “Users use to have to put their ID information into each new website when they logged into that website. … It would be up to the collector of that data — for example, the platform itself — to properly encrypt it, properly transmit it to the state for verification. … That is sort of being eliminated now.”

More countries are adopting regulations to create digital ID systems that connect real-world identities with online personas. In 2024, Australia, for example, adopted the Digital ID Act of 2024 to extend its government digital ID, allow private-sector participation, and expand privacy protections. Singapore has long had a digital ID, SingPass for citizens to conduct transactions with government services, modeling it on Estonia’s digital-government system.

China’s approach, however, has raised significant fears about increasing government surveillance in the name of data security and privacy. While the measures have privacy and notification clauses, numerous exceptions mean that authorities could easily access personal data without notification, according to an analysis by the Network of Chinese Human Rights Defenders (CHRD), a non-government collective of domestic and overseas Chinese human rights activists and groups, and Article 19, an international non-governmental organization.

The new Internet ID system is not about protecting privacy but about strengthening the state’s surveillance infrastructure, says Shane Yi, a researcher with CHRD.

“The system centralizes more control over digital identity,” he says. “When authorities can revoke your Web certificate, they can effectively erase your entire online existence — an escalation from the previous system where being banned from one platform could still leaves access to others.”

Privacy, Government-Style

The Internet ID numbers, or Network Numbers, focus on centralizing the verification of citizens’ digital identities. China’s government requires real-name verification, which can cause data-security problems because that process is distributed among many online services. Under the new measures (translation), which went into effect on July 15, 2025, if a citizen uses a digital ID, Internet platforms cannot store information about their real identity, according to the Chinese regulation.

“After internet platforms access the Public Service, where users elect to use Network Numbers or Network Credentials to register and verify their real identity information, and pass verification, the internet platforms must not require that the users separately provide explicit identification information, except where laws or administrative regulations provide otherwise or the users consent to provide it,” the regulation stated.

The Public Service Platform must store user data domestically or, if data needs to be stored abroad, conduct a thorough security assessment.

Chinese officials have argued that the approach also improves privacy for citizens. Lin Wei, president of the Southwest University of Political Science and Law in Chongqing, China, claimed that the 67 sites and applications that have adopted the virtual ID service collect 89% less personal information. The academic’s article was reportedly published by China’s Ministry of Public Security.

Surveillance Concerns Abound

The Chinese government has not provided details about how the system is constructed or the policies in place to protect the data from misuse, Yi says. However, for digital-rights activists, the danger is clear.

“The pattern is unmistakable — promise redress with one hand while creating surveillance loopholes with the other,” he says. “When the same government that jails activists for ‘subversion’ can secretly monitor their digital lives under vague ‘confidential’ exemptions, we’re not looking at privacy protection — we’re looking at mass surveillance dressed up as user rights.”

Whether the verification measures will lead to greater oversight of citizens’ online activities depends on future government actions and the point of view, Trivium’s Schaefer says.

“The perception both from the state-level and, frankly, from many citizens, is the government’s job is to protect me and my data from hackers and marketers,” she says. “The government conveniently gets to leave itself out of that equation, but there is a genuine perception by the government … that it is the sort of protector of data, and that means it gets access to that data in some ways.”