Legal Boundaries for Developers

Before doing anything, ask whether the vendor, platform, or company will report the incident to police. Server logs, payment records, and chat logs are all easily obtained during an investigation. If you are criminally detained, authorities must decide within 37 days whether to formally arrest you. You may hire a lawyer from the very first interrogation onward; those 37 days are the most critical window for securing effective legal representation.

Cost

No cost at all. Before acting, replace the question “Is this technically feasible?” with “Will the vendor, platform, or company file a police report?” The hard part is resisting the urge to think “this is a minor issue no one will care about” — server logs, payment records, and chat logs are all routinely subpoenaed during investigations.

Benefit

Any organization or individual who becomes aware of a crime may file a police report. Once authorities deem a crime to have occurred, they must open an investigation. After a criminal detention, police must request formal arrest approval from prosecutors within three days; this period may be extended by one to four days under special circumstances, or up to 30 days in cases involving multiple locations or serial offenses. Prosecutors then have seven days to make a decision. In total, the maximum timeframe for deciding whether to arrest is 37 days. From the first interrogation or upon being placed under any compulsory measure, you may retain legal counsel; during the police investigation phase, only lawyers may be hired. Lawyers must be granted access to clients within 48 hours of requesting a meeting. If the potential sentence involves lighter penalties such as probation or fines rather than imprisonment, you may be released on bail by posting a bond or securing a guarantor; this bail period may last up to 12 months nationwide.

Note

These 37 days refer strictly to the interval between detention and the prosecutor’s decision on arrest; they do not represent the overall maximum detention period. Additional detention limits apply during the subsequent investigation phase. It is precisely during these 37 days that experienced attorneys can be most effective — meeting clients, submitting arguments to prosecutors that arrest is unwarranted, and applying for bail. Seeking legal help after indictment is far too late. All other items in this section address the same underlying issue: whether the other party has grounds to file a report.

Selling to just 20 users or earning 5,000 yuan is enough to qualify as “serious circumstances,” leading to a sentence of up to three years. In especially serious cases the penalty ranges from three to seven years. One developer who created aim‑assist and wall‑hack cheats sold them over 80,000 times in three months, netting more than 30,000 yuan; he received a one‑year suspended sentence plus a 5,000‑yuan fine. Another individual obtained the game’s server code, ran a private server, and collected over 20 million yuan in payments; he was sentenced to four years in prison and fined up to 10 million yuan.

Cost

There is no monetary cost. The trade‑off is giving up potential income from such orders and “small tools.” The difficulty lies in the fact that this money comes quickly and it’s unclear who might eventually pursue legal action.

Benefit

Distributing programs or tools designed to intrude upon or illegally control computer systems can result in imprisonment of up to three years, along with a fine, or a fine alone if the circumstances are deemed “serious.” For especially serious cases the sentence rises to three‑seven years plus a fine. The threshold for “serious circumstances” is reaching 20 users or generating at least 5,000 yuan in illicit profit. Intentionally bypassing or sabotaging technical protection measures may also constitute copyright infringement, punishable by up to three years, or up to ten years in more severe instances. Official examples include Wang and others who sold memory‑modifying cheats; they earned over 30,000 yuan in three months and received a one‑year suspended sentence plus a 5,000‑yuan fine. Another case involved Xiang and others who sold the “TZ” series of cheats, generating over 200,000 yuan; Xiang got three years suspended and a 20,000‑yuan fine. Liu and others obtained server code, altered parameters, and ran a private server that attracted over 20 million yuan in payments; they received sentences ranging from four years down to two years and six months, along with fines from 1 million to 1.3 million yuan nationwide.

Note

All published cheat‑related rulings involve programs that read or modify game memory and circumvent anti‑cheat systems. No official cases have yet addressed aids that merely capture screenshots or simulate keystrokes. Nevertheless, a recent ticket‑scaling case shows that even tools that do not touch memory but merely send requests can be deemed illegal data‑acquisition tools. Whether an act qualifies as a crime and which charge applies is determined by law‑enforcement agencies based on evidence supplied by game developers, not by the author’s interpretation. The requirement of just 20 users to meet the “serious circumstances” threshold is quite low.

Even if a script does not modify memory or bypass security measures and merely sends requests faster than a human can, it still qualifies as illegal acquisition of computer system data. The legal threshold is either earning over 5,000 yuan or causing at least 10,000 yuan in losses. One individual bought multiple 12306 accounts and used them to snatch over 200 train tickets, netting more than 20,000 yuan; he was sentenced to 1 year and 6 months in prison, suspended for the same period, plus a fine of 5,000 yuan. Another person sold ticket‑snatching software online and was found guilty of unfair competition, ordered to pay 20,000 yuan in damages.

Cost

No expense and no time required

Benefit

Illegally accessing computer systems or obtaining their data via any technical means can lead to imprisonment of up to 3 years, a fine, or both; more serious cases incur 3–7 years in prison. The threshold for “serious circumstances” is earning over 5,000 yuan illegally or causing losses exceeding 10,000 yuan. Official cases include a person who used a bot to submit numerous ticket‑purchase requests using purchased 12306 accounts; he snatched more than 200 tickets and earned over 20,000 yuan, resulting in the same sentence as above. Zheng sold ticket‑snatching software for a specific booking app and was ordered to pay 20,000 yuan for unfair competition (national precedent).

Note

Even scripts that do not alter memory or bypass security and merely operate faster than humans still fall under Article 285 of the Criminal Law. Both paid ticket‑snatching services and selling such scripts are considered profit‑generating activities. No official cases have been reported for individuals using such scripts solely for personal use.

Any data that requires a login, a token, or signature decryption to access falls under bypassing protective measures; violations are punishable by up to 3 years in prison, or 3 to 7 years in more serious cases. Collecting personal information brings even heavier penalties. Possessing 50 or more records related to personal movement, communications, credit history, or financial information is already considered a serious offense. The same applies if you collect 500 or more records on accommodation, health, or transaction details, 5000 or more records of other types, or earn 5000 yuan or more from such activities.

Cost

No cost at all. A crawler is simply a program that automatically browses web pages and extracts the data on them. Before running one, check the robots.txt file and any API authorization guidelines — robots.txt is a file placed by website owners in their root directory that lists pages they do not want crawlers to access. Any data that requires a login, a token (a temporary access credential), or signature decryption to obtain is not targeted. The real challenge is resisting the temptation to collect such data even when technical means make it easy to do so — this depends entirely on self-discipline.

Benefit

Illegally accessing system data by bypassing protective measures carries the same sentencing range as the third item (scripts used for ticket scalping or flash sale fraud): up to 3 years in prison, or 3 to 7 years in more serious cases. Illegally obtaining, selling, or providing citizens’ personal information also triggers heavy penalties if any of the following thresholds are met: 50 or more records on personal movement, communications, credit history, or financial details; 500 or more records on accommodation, communications, health, or transaction information; 5000 or more records of other types; or illegal earnings of 5000 yuan or more. Serious violations result in up to 3 years in prison, plus a fine or fine alone; extremely serious cases are punished with 3 to 7 years in prison. A real-world example: software developer Li used a feature disguised as a “face beauty detection” tool to steal 1751 facial photos from users’ phone albums, then sold data from a social engineering database he had compiled — he was sentenced to 3 years in prison, suspended for 3 years. A social engineering database is a collection of personal information leaked from various sources. Another case: an internet technology firm used a crawler to harvest store and order data from a food delivery platform, causing over 40,000 yuan in losses; it was prosecuted for illegally obtaining data from a computer information system (this case is documented nationwide).

Note

A 2017 judicial interpretation states that “providing information lawfully collected from others without their consent” also counts as “providing personal information” under the law. This provision also applies to companies that share user databases with external partners. 5000 records is roughly the size of a small database table.

Taking on such high-paying yet poorly defined projects means you could be treated as an accomplice in gambling crimes, facing charges under the crime of operating illegal gambling dens: up to 5 years in prison, or 5–10 years for serious cases. This is not the “merely helping out, maximum 3 years” category. In one e-sports betting app case, 28 developers in Hainan were sentenced to 1–3 years and 6 months for operating illegal gambling dens. Those who unblocked QQ accounts for fraud rings received 1 year and 6 months in prison plus a 20,000-yuan fine.

Cost

No direct monetary cost. The trade-off is forgoing outsourcing projects that pay well but have vague requirements. The difficulty lies in the fact that these clients often offer significantly higher pay than normal projects.

Benefit

Providing technical support or payment settlement services to known online criminals can lead to imprisonment of up to 3 years and/or a fine, especially when the circumstances are serious. If other crimes are also involved, the harsher penalty applies. Operating illegal gambling dens carries up to 5 years in prison plus a fine; serious cases bring 5–10 years. Official examples: Zhangsheng Group developed gambling games and handled “online distribution,” earning fees for website setup and reporting; the total illicit revenue reached nearly 7 billion yuan. Its leader was sentenced to 9 years and 9 months plus a 50-million-yuan fine. 79 developers, including Wang Qiang, received sentences ranging from 6 months to 9 years and 9 months. In another case, 28 developers in Hainan who built an e-sports betting app were convicted of operating illegal gambling dens and received similar sentences, plus fines. One individual who ran a studio unblocking QQ accounts for fraudsters got 1 year and 6 months in prison and a 20,000-yuan fine (nationwide).

Note

“Knowing intent” does not require the client to explicitly state the purpose. When a quote is far above market rates, the app includes top-up, cash-out, and betting features, and the client refuses to disclose usage, these facts are used to prove you were aware of the illegal nature. Developers of gambling apps are prosecuted as accomplices in operating illegal gambling dens, not under the “Crime of Assisting Information Network Criminal Activities” which caps at 3 years.

Account credentials are issued by the employer, but they do not remain valid after you leave the job. Logging in using those credentials constitutes illegal control of computer systems, punishable by up to 3 years in prison. Deleting data to render the system inoperable is punishable by up to 5 years in prison; more severe cases incur sentences exceeding 5 years. One example: a dismissed senior engineer logged into his former employer’s servers using his original admin credentials, deleted data and logs, resulting in over 120,000 yuan in losses. He was sentenced to 3 years in prison, suspended for 5 years, and fined 30,000 yuan.

Cost

No cost involved. If the employer owes you wages, pursue them through labor arbitration (see Section 7 on labor arbitration). The real challenge is resisting the urge to tamper with the system while angry.

Benefit

Illegal control of computer information systems is punishable by up to 3 years in prison, with or without a fine; more serious cases incur sentences ranging from 3 to 7 years. Deleting or altering system functions or data to the point the system cannot operate normally is punishable by up to 5 years in prison; more severe cases incur sentences exceeding 5 years. Official cases include: after being dismissed, senior IT engineer Lü used his original admin account to access his former employer’s shared servers, changed passwords, and deleted data and logs, causing over 120,000 yuan in losses; he received the same sentence as above. Another case: Bai, an employee at a software firm, deliberately inserted faulty code into an upgrade program, rendering client systems inaccessible and causing over 40,000 yuan in losses; he was prosecuted for disrupting computer information systems nationwide.

Note

Account credentials are issued by the employer, but they do not remain valid after you leave the job. Logging in using original credentials constitutes “illegal control.” Losses are calculated based on data recovery costs; amounts in the tens of thousands of yuan are sufficient to initiate legal proceedings.

Even code written by you personally remains the company’s intellectual property — taking it away is essentially stealing company assets. Client lists also qualify as trade secrets. In one case, a former employee who took source code and core algorithms of a security inspection system to a new employer was sentenced to 5 years in prison and fined 500,000 yuan; the new employer was fined 4 million yuan. Another individual who exploited system vulnerabilities to download over 33,000 design files was sentenced to 1 year and 10 months in prison and fined 100,000 yuan. Beyond criminal penalties, companies can also pursue separate civil compensation claims.

Cost

No cost involved. Before leaving, simply delete all company-related files from your personal computer and cloud drives. The difficulty lies in the fact that some files were written by you personally, making it hard to part with them.

Benefit

Violating confidentiality obligations by disclosing or personally using trade secrets may result in imprisonment of up to 3 years, along with a fine or both. In more serious cases, the sentence ranges from 3 to 10 years, plus a fine. The Anti-Unfair Competition Law also deems two acts as violations: using technical means to illegally access systems and obtain trade secrets, and aiding or abetting others in breaching confidentiality. Official examples include the aforementioned cases where former employees took source code and algorithms to new employers, resulting in heavy criminal and financial penalties. Additionally, an engineer who stored App module source code on personal devices and later developed a similar product after changing jobs was prosecuted for trade secret infringement nationwide.

Note

Code written by employees remains the company’s property, as stipulated in Article 13 (code developed using company resources belongs to the company). Taking such code away is equivalent to stealing company assets. Client lists are classified as business information and also qualify as trade secrets. Apart from criminal penalties, companies may also file separate civil lawsuits for compensation.

Controlling someone else’s computer, server, or camera without permission is illegal. Operating 20 or more such devices qualifies as a serious offense, punishable by up to 3 years in prison; especially severe cases may incur 3 to 7 years. Even if it does not rise to a criminal offense, offenders can still be detained for up to 5 days and fined between 50,000 and 500,000 yuan. For tech professionals, the most damaging consequence is a lifelong ban from holding key positions in cybersecurity management and network operations after any criminal conviction.

Cost

No expense and no time loss

Benefit

Illegally controlling computer information systems is a crime. Serious cases result in up to 3 years in prison plus a fine; especially severe cases incur 3 to 7 years. Controlling 20 or more devices is deemed “serious.” Those not meeting criminal thresholds still face confiscation of illegal gains, up to 5 days of detention, and fines ranging from 50,000 to 500,000 yuan. More serious violations bring 5 to 15 days of detention and fines from 100,000 to 1,000,000 yuan. Anyone with a prior public security penalty is barred for 5 years, while those with a criminal record are barred for life from critical cybersecurity and network operation roles. Example: Li was sentenced to 3 years in prison suspended for 5 years and fined 20,000 yuan after using software to illegally control 105 surveillance cameras; Wu and others received 2 to 4 years and 6 months in prison for implanting malware into mobile phone motherboards to harvest verification codes from over 3.3 million devices.

Note

No published cases from China’s Supreme People’s Procuratorate or Supreme People’s Court address mining on company servers; this entry is written under the legal provision concerning unauthorized system control. The lifelong ban from key roles is an additional consequence under China’s Cybersecurity Law, carrying heavier weight for tech professionals than monetary fines alone.

Whether a crime is established depends solely on whether you had permission and how much access you obtained — not on your intentions. Possessing 500 sets of ordinary account credentials, or earning 5,000 yuan while causing 10,000 yuan in losses, is enough to warrant a sentence of up to three years. Even a single attempt to export a user list to prove a vulnerability often exceeds that 500‑credential threshold. Using credentials you already possess outside their authorized scope also constitutes unauthorized access.

Cost

No cost at all. Before joining a vendor’s SRC or public beta test, obtain a document that clearly defines the permitted scope, target systems, and allowed testing windows. An SRC is a vendor-run security response center designed to receive external vulnerability reports. Once a vulnerability is confirmed, testing must stop. The real challenge is resisting the urge to “give it a quick try.”

Benefit

This law applies to computer information systems belonging to ordinary companies and individuals, excluding those used for national affairs, defense, or cutting‑edge scientific research. Unauthorized intrusion or use of any technical means to obtain stored, processed, or transmitted data may lead to imprisonment of up to three years, a fine, or both, if the circumstances are serious; for especially serious cases, the sentence ranges from three to seven years with a fine. “Serious circumstances” include obtaining ten or more authentication credentials for online financial services such as payments or securities trading, 500 or more other authentication credentials, illegally controlling 20 or more computers, or earning illicit profits exceeding 5,000 yuan or causing losses above 10,000 yuan. Five times these thresholds define “especially serious” circumstances. Prosecutorial Example No. 36 states that “using accounts or passwords beyond the granted scope to log into a computer system is itself an act of unauthorized intrusion.” In that case, three individuals used work‑related credentials to access their company’s internal system, downloaded non‑work data, and sold it for 37,000 yuan; they received sentences of 4 years, 3 years 9 months, and 4 years respectively, plus fines of 40,000 yuan each.

Note

Prosecutorial Example No. 36 involves a data‑selling scheme; it is cited only for the principle that exceeding authorized scope counts as intrusion, not to suggest that well‑meaning tests incur identical penalties. Intentions and post‑test reporting cannot erase criminal liability; they may only influence sentencing or whether charges are filed. A vendor’s initial thanks and later filing of a report are not mutually exclusive — gratitude does not equal permission. At the time of writing, no publicly documented cases on permissible testing were found on the Supreme People’s Court or Supreme People’s Procuratorate websites; therefore this description relies on statutory provisions and penalty criteria. Always participate through a vendor’s official SRC or under a written contract that specifies scope, targets, and time limits. To prove a vulnerability, collect only minimal evidence and avoid bulk data extraction. Even conduct that does not meet criminal thresholds remains subject to administrative penalties, professional bans, and fines comparable to those outlined in Section 8 (running unauthorized programs on others’ machines). Guidance on post‑disclosure procedures appears in Section 10 (reporting vulnerabilities as required).

The “Regulations on the Management of Security Vulnerabilities in Network Products” applies not only to companies but also to individuals. There are five strict rules for vulnerability disclosure; the first two state that no details about vulnerabilities affecting active systems may be released before a vendor provides a fix. Additionally, no programs or tools specifically designed to exploit those vulnerabilities may be published, and any release must include instructions on how to remediate them. One often-overlooked rule: unreported vulnerabilities must not be shared with any foreign organizations or individuals outside the vendor.

Cost

No cost involved. Simply report the vulnerability to the product vendor or an official platform. Until the vendor releases a patch, no details or verification code should be disclosed.

Benefit

These regulations govern three main groups: domestic network product vendors, network operators, and any organizations or individuals involved in discovering, collecting, or publishing vulnerability information. No entity may use vulnerabilities to compromise network security, nor may they illegally collect, sell, or distribute such information. Five additional rules apply to public disclosure: first, nothing may be released before a vendor provides a patch; second, no details about vulnerabilities in active networks or systems may be published; third, no exaggerated claims about risks or malicious exploitation attempts may be made; fourth, no tools or programs designed for malicious exploitation may be released; and fifth, any disclosure must include remediation steps. Unreported vulnerabilities must also not be shared with foreign entities. The regulations encourage reporting to four official platforms: the Ministry of Industry and Information Technology’s Cybersecurity Threat and Vulnerability Information Sharing Platform; the National Cybersecurity Information Notification Center’s Vulnerability Platform; the National Computer Network Emergency Response Technical Team/Coordination Center of China’s Vulnerability Platform; and the China Information Security Evaluation Center’s Vulnerability Database. Violators may face penalties ranging from fines of 10,000 to 100,000 RMB, suspension of services, revocation of licenses or business licenses, and even criminal liability for responsible personnel.

Note

This regulation explicitly includes individuals as subjects; claiming “I’m just an amateur” does not exempt anyone from compliance. Submitting vulnerabilities found in domestic systems to foreign bug bounty platforms violates the rule prohibiting disclosure to foreign entities. This rule addresses how vulnerabilities must be handled after discovery. Whether one is legally permitted to test systems depends on other provisions, such as the requirement for written authorization before testing any system. Even legally discovered vulnerabilities may incur penalties if disclosed improperly. Unauthorized testing results in violations on both fronts. Among reporting channels, the MIIT platform and CNCERT are most commonly used. The regulations do not specifically address cases where a vendor is notified but fails to act; in practice, documentation of negotiation and reporting processes is required before official submission.

Any individual or entity that builds their own outbound network connections or uses international channels outside of state-provided public telecom services may be ordered by police to cease internet access, receive a warning, and face fines up to 15,000 yuan plus confiscation of any illegal earnings. Those running businesses based on such services may be charged with illegal business operations; in severe cases, imprisonment of up to five years applies. This rule specifically addresses selling or setting up such nodes. For personal use only, the maximum penalty remains limited to a warning and fine as stipulated in Article 14 of the provisional regulations.

Cost

No expense or time required

Benefit

Direct international internet connectivity must be facilitated via international gateway channels supplied by state-owned telecom networks. No organization or individual may independently establish or utilize any other channels, meaning neither private outbound connections nor third-party nodes are permitted. Violators face police orders to disconnect from the internet, warnings, and possible fines up to 15,000 yuan plus confiscation of illicit profits. Commercial operators violating this rule may be prosecuted for illegal business operations; severe violations incur up to five years imprisonment plus fines ranging from one to five times the illegal earnings. Particularly egregious cases may result in imprisonment exceeding five years nationwide.

Note

At the time of drafting, no publicly documented court rulings regarding firewall circumvention were found on Supreme People’s Court or Supreme People’s Procuratorate websites, and regional enforcement practices vary widely; hence this B rating was assigned. This section exclusively addresses selling or setting up such nodes. For personal usage alone, the maximum penalty remains limited to warnings and fines as outlined in Article 14 of the provisional regulations.

A non-compete clause simply means you’re not allowed to work for a competitor for a certain period after leaving your job. This rule is there to protect you. The maximum duration is 2 years, and the employer must pay compensation every month. If the amount isn’t specified, it’s calculated as 30% of your average monthly wage over the previous 12 months, and it can’t be lower than the local minimum wage. If the employer fails to pay for 3 months due to its own reasons, you can ask to end the agreement. Starting in 2025, workers who never learned about or handled any trade secrets at their job can request that the non-compete clause be ruled invalid.

Cost

No cost involved. Keep the original non-compete agreement and any proof that the employer didn’t make monthly payments after leaving the job.

Benefit

Non-compete clauses only apply to senior executives, highly skilled technicians, and anyone with a duty to keep secrets. The maximum term is 2 years, and the employer must provide monthly financial compensation during that time. If the amount isn’t set, it’s 30% of your average monthly wage over the last 12 months, never lower than the local minimum wage. If the employer doesn’t pay for 3 months for reasons on its end, you can ask to cancel the clause. If the employer ends it voluntarily, it must pay an extra 3 months of compensation. From 2025, workers who never knew about or touched any trade secrets can ask to have the clause declared void. Any part of the clause that goes beyond what they actually knew about is also invalid. Official case example: A pharmaceutical firm sued its former CTO, Zheng, seeking 7.1 million yuan in damages. The court ruled that Zheng’s new employer’s products had no overlap with the original firm’s offerings, so the non-compete scope should be limited to what Zheng actually knew. The claim was dismissed in full (nationwide ruling).

Note

This rule is there to protect you. On the flip side, if the agreement is valid and the employer pays as required, but you still go to work for a competitor, you’ll have to pay the agreed-upon penalty. Even after paying that, you might still be required to serve out the remaining non-compete period. Non-compete terms agreed upon while you’re still employed also count as valid, even if no extra payment is made by the employer.

Work‑related creations are defined as works made in the course of your duties. Software is explicitly listed in law as “copyright belonging to the employer.” If a program is primarily produced using company hardware, internal networks, or business data — and the company assumes responsibility for it — then the copyright rests with the employer. The same applies when the contract states this. As the creator, you retain only the right to be credited. Inventions developed using company resources also belong to the company, with patent rights following the same rule. Even if you write code “after hours,” using a company computer or business data can still make it qualify as a work created mainly with employer resources.

Cost

No cost involved. When you start a new job, be sure to read the intellectual‑property clauses in your employment contract. The main difficulty is that personal projects and work tasks often share the same computer, so you must keep them separate.

Benefit

Works produced to fulfill job duties are considered “work‑made‑for‑hire.” Under normal circumstances the author keeps copyright, while the employer has the right to use them for its own business and may not allow third parties to use them in the same way for two years. However, two exceptions exist: works such as software or engineering designs that are created mainly with employer resources and for which the employer bears responsibility, and any works expressly assigned to the employer by contract. In both cases the author retains only the right to be credited. “Employer resources” include hardware, internal networks, and business data. Inventions created while performing job duties or using those same resources are classified as “work‑made‑for‑hire inventions,” with all patent rights belonging to the employer nationwide.

Note

Software is explicitly categorized as “copyright belonging to the employer,” so programmers rarely qualify for the standard rule granting them copyright while the employer retains a two‑year exclusive right to use it. Code written outside work hours can still be deemed a product of employer resources if it is produced on a company computer, accessed company networks, or uses business data. To keep personal projects truly separate, use your own machine, avoid company repositories, and ensure they do not overlap with any company work.

Copyright infringement requires you to compensate the copyright holder based on their actual losses or the profits you earned from the infringement. If you commit infringement intentionally and under aggravating circumstances, you may be ordered to pay damages ranging from 1 to 5 times the original amount. One company hired a former employee of a competitor and developed software that was substantially similar to the competitor’s product. The company argued that since the competitor’s software used GPLv2, it was required to be open-source anyway. The Supreme People’s Court ruled that whether a developer complies with GPLv2 or not has no bearing on their copyright rights, and ordered the company to cease infringement and pay 500,000 yuan in damages.

Cost

There is no cost involved. Before using someone else’s open-source code, check its license for any stated usage terms. The GPL family of licenses requires that any product built using it must also have its source code released, which conflicts with selling the product as closed-source software for profit. If such a conflict exists, you must switch to another license. The hard part is giving up a library you’ve already grown comfortable using.

Benefit

Copyright infringement demands compensation based on the rights holder’s actual losses or the infringer’s profits. If neither of these can be accurately calculated, damages are determined by how much it would cost to obtain a proper license for the same software. Intentional and aggravated infringement can also result in 1 to 5 times the standard compensation amount. If the infringement harms public interests, any illegal profits may be confiscated and fines imposed. A relevant official case is Supreme People’s Court Civil Appeal No. 51 of 2021. In this case, a defendant hired a former employee of a plaintiff and developed gateway software that was substantially similar to the plaintiff’s product. The defendant claimed the plaintiff’s software used GPLv2 and thus should have been open-source. The Supreme People’s Court reiterated that compliance with GPLv2 and copyright ownership are two separate issues, and ordered the defendant to cease infringement and pay 500,000 yuan in damages nationwide.

Note

This case makes it clear that “the other party used GPL code” cannot serve as justification for copying their software. Conversely, there are already effective court rulings in China where GPL authors successfully sue commercial entities that fail to release source code. No original text of these rulings could be found on the Supreme People’s Court website, so they are not cited here. This item is graded B because compliance with open-source licenses is governed only by general contract and copyright laws, without any specific legal provisions dedicated to this area.

Only gather information that is genuinely needed for business purposes, and obtain consent from a guardian for any user under 14. For violations, regulators first order corrections and issue warnings, and may also confiscate illegal earnings; the app can be ordered to suspend or terminate its services. If the violation persists, fines up to 1 million RMB can be imposed on the app, while individuals directly responsible may be fined between 10,000 and 100,000 RMB. In severe cases, fines can reach 50 million RMB or 5 % of the previous year’s revenue, and responsible personnel may face fines from 100,000 to 1 million RMB. The term “directly responsible personnel” can include the technical and product staff who actually implement the app.

Cost

No cost involved. Before launch, cross‑check the list of permissions the app requests against the privacy policy and remove any unnecessary permissions. The main challenge is that product teams often want to retain data “just in case it might be useful later.”

Benefit

Personal data should be processed only for a clear, legitimate purpose that is directly related to that purpose, using methods that minimize impact on individuals’ rights. Consent from the individual is required unless another legal basis applies. For users under 14, consent from parents or guardians is mandatory. Violations lead to regulatory orders to correct the problem, warnings, and confiscation of illegal earnings; the offending app may be suspended or shut down. Persistent breaches incur fines up to 1 million RMB, while responsible managers and staff may be fined between 10,000 and 100,000 RMB. In extreme cases, fines can exceed 50 million RMB or 5 % of annual revenue, and those individuals may be barred from serving as directors, supervisors, or executives of related companies. Criminal acts involving the sale or disclosure of personal data are covered under Section 4 (National).

Note

In practice, the “directly responsible personnel” label often applies to developers and product managers. The Ministry of Industry and Information Technology regularly publishes lists of removed or penalized apps; however, no specific announcement was identified for this section, so it is not cited here.

ICP registration costs nothing, and the cloud provider’s process takes a few weeks. Domestic servers without registration will be shut down. Providers that claim registration is free but charge fees face fines ranging from 100,000 to 1,000,000 yuan. You must retain logs for at least 6 months; failure to comply or causing any consequences results in fines of 10,000 to 100,000 yuan.

Cost

Registration itself is free; using a cloud provider’s process takes a few weeks. Fees for classification protection assessments vary by level. Classification protection, also known as “DB”, is a set of national security management measures that classify systems based on their importance; small websites generally do not need to undergo assessments.

Benefit

Commercial internet information services require a license, while non-commercial ones need only registration. Operating without a license or registration is prohibited. Non-compliant sites will be ordered to make corrections by telecom authorities; refusal leads to site closure. Unlicensed operators face confiscation of illegal earnings plus fines of 3 to 5 times those earnings, or fines ranging from 100,000 to 1,000,000 yuan. Failure to display the ICP registration number on a website’s homepage incurs fines of 5,000 to 50,000 yuan. Network operators must develop security policies under classification protection rules, defend against attacks, retain logs for at least 6 months, and encrypt and back up data by category. Non-compliance leads to corrective orders and warnings; persistent violations result in fines of 10,000 to 100,000 yuan for operators and 5,000 to 50,000 yuan for responsible personnel nationwide.

Note

Domestic servers cannot be accessed via domain names without ICP registration. Details on how to register, associated penalties for missing registration numbers, and how to verify a provider’s qualifications are covered in Section 26, Item 4 (domestic servers must be registered). Common pitfalls include registering as a personal non-commercial site while actually charging fees, and failing to update registration after changing domains or operators. Keeping logs for 6 months is both a legal obligation and a safeguard; they can prove your innocence in case of incidents.

If you offer generative AI services with public influence or social mobilization potential to the general public, you must perform a safety assessment and register the algorithm per national regulations before launch. Any changes or shutdowns also require filing updates or cancellation paperwork. All generated images and videos must be clearly marked. Tools meant solely for personal use and not open to the public are exempt from these requirements. The regulation itself does not specify penalties; violations are handled under the Cybersecurity Law, Data Security Law, and Personal Information Protection Law.

Cost

There is no monetary cost, but you must follow procedures set by internet regulators — completing them takes some time. Small personal tools that are not made available to the public do not fall under these rules.

Benefit

Providers of generative AI services that can shape public opinion or mobilize people must conduct safety assessments, register their algorithms, and handle subsequent updates or cancellations as required by law. “Public influence” or “social mobilization potential” means the ability to affect how people think or to organize them. Providers must also add identifying marks to any generated images or videos. This regulation took effect nationwide on August 15, 2023.

Note

The regulation itself does not state exact penalty amounts. Violations are penalized under the Cybersecurity Law, Data Security Law, and Personal Information Protection Law, which is why this item is rated B. No civil cases involving copyright or portrait rights violations caused by AI‑generated content are cited here, as the original texts were not verified on the Supreme People’s Court website.

Developing software that automatically skips or blocks advertisements embedded in third-party applications can lead to unfair competition lawsuits from content platforms. Charging zero fees does not provide a legal shield; statutory antitrust laws define business operators to include natural persons providing services. In judicial precedents, a web browser that blocked streaming video pre-roll ads was ordered to pay 800,000 RMB ($112,000 USD) in damages, and an Android utility that bypassed app splash-screen ads was ordered to pay 90,000 RMB.

Cost

Zero direct cost. The trade-off is relinquishing a popular developer utility. The psychological difficulty is feeling that you earned no money and merely automated the user's voluntary tap on a "Skip" button.

Benefit

Under the Anti-Unfair Competition Law (revised 2025), business operators are prohibited from utilizing technical means to obstruct or sabotage the normal operation of legitimate network products or services provided by other operators. Business operators include natural persons, legal entities, and unincorporated organizations offering commercial goods or services. Liable parties must compensate for actual losses inflicted on the victim platform or disgorge unlawful benefits derived from the interference, alongside reimbursing all reasonable enforcement expenses. Market regulation authorities are also empowered to impose administrative fines ranging from 100,000 to 1,000,000 RMB (escalating to 1,000,000–5,000,000 RMB for severe violations). Official Judicial Precedents: In the landmark "720 Browser" litigation, a browser built-in feature intercepted pre-roll and pause advertisements on Mango TV. The Guangzhou Intellectual Property Court reversed the trial decision on appeal, finding actionable unfair competition and awarding 800,000 RMB in economic damages and reasonable costs—a case selected by the Supreme People's Court as a national antitrust/unfair competition typical guiding case in 2021. In another case, the "Lan Jingling" mobile app bypassed Mango TV's splash-screen launch ads; the Beijing Intellectual Property Court affirmed on appeal in April 2024 that the utility effectively blocked the ads rather than merely automating user clicks, ordering 80,000 RMB in damages and 10,000 RMB in costs.

Note

Primary beneficiary is yourself. The appellate court distinguished between individual users manually clicking "skip" (which is lawful) and software distributing automated technical bypasses targeting third-party ad delivery infrastructure. In August 2023, the popular free ad-skipping utility "Li Tiaotiao" received formal cease-and-desist attorney demands from Tencent alleging unfair competition, prompting its developer to suspend all updates indefinitely despite operating as a non-profit tool supported solely by sporadic donations. When independent developers receive corporate cease-and-desist notices, legal defense costs in civil litigation must be funded entirely out-of-pocket. Scripting private automation tools strictly for your own personal device without distribution carries no verified enforcement records. Liability for automated ticket-purchasing bots is covered in Chapter 11, Rule 3. Benefit magnitude is categorized as High based on avoiding six-figure intellectual property judgments. Primary beneficiary is yourself.

"AI relay stations" are unauthorized proxy websites that batch-purchase overseas LLM API subscriptions and resell access tokens cheaply to domestic users. In Shanghai, an unauthorized relay operator was criminally detained for 37 days, subsequently released on bail while awaiting formal prosecution and confiscation of unlawful proceeds. National security agencies have issued warnings that many illicit relay proxies lack telecom licenses and unlawfully route domestic user prompts and sensitive data to overseas servers.

Cost

Zero financial outlay. The opportunity cost is giving up an easy, high-cash-flow side hustle. Legitimate enterprise model aggregation requires telecommunications operating permits, authorized corporate API contracts, and substantial compliance capital.

Benefit

In June 2026, the Ministry of State Security (MSS) issued a formal security advisory regarding "AI Relay Stations." The advisory outlined that unauthorized relay stations act as unregulated intermediary proxy layers between end-users and official model providers. Many such proxy operations operate without basic telecommunications and data processing qualifications. They systematically bypass cross-border data transfer security assessments and statutory approval processes, transmitting user inputs and corporate proprietary data directly to foreign servers, while facilitating bypass of network access controls and licensing restrictions. In an investigative report by China Newsweek (June 2026), an operator of an unauthorized AI proxy portal published a public shutdown announcement in a technical community after being held in criminal detention by Shanghai police for 37 days for illicit API acquisition, followed by release on bail pending trial. The operator confirmed facing imminent criminal sentencing alongside restitution, disgorgement of illicit gains, and criminal fines. Unregulated proxies typically bulk-register overseas enterprise accounts or exploit leaked API tokens, routing traffic through foreign jump servers to undercut official pricing.

Note

Grade C is assigned because this enforcement pattern is documented through investigative media reports, public regulatory advisories, and operator disclosures, without publicly released final court verdicts detailing formal statutory criminal charges. While legal literature suggests charges ranging from illegal business operations to computer information system offenses, operators face verified risks of felony detention. Lawful model aggregation requires commercial telecommunications value-added licenses (see Chapter 26, Rule 2), statutory generative AI security filings (see Chapter 11, Rule 17), and strict compliance with cross-border data transfer regulations (see Chapter 26, Rule 10). Risks to end-users utilizing unauthorized AI relays are covered in Chapter 14, Rule 10. Benefit magnitude is categorized as High based on avoiding criminal detention and asset forfeiture. Primary beneficiary is yourself.

License key validations, cryptographic dongles, and DRM are statutory technical protection measures. Bypassing them without authorization is civil infringement even if no money is charged. Cracking software or selling crack tools for profit constitutes criminal copyright infringement once illegal gains reach 30,000 RMB or business revenue reaches 50,000 RMB, punishable by up to 10 years in prison. In one case, three individuals manufacturing cracked dongles and pirated software received 1 to 3.2 years' imprisonment.

Cost

Zero financial outlay. The cost is forfeiting quick side-hustle revenue from selling cracked builds, registration keys, or modified dongles. Never upload crack patches to public developer forums, GitHub repositories, or cloud drives. The psychological hurdle is realizing that reverse-engineering feels like pure technical craftsmanship rather than criminal theft.

Benefit

Under civil law, the Copyright Law authorizes rights holders to implement technological measures—effective technologies, devices, or components designed to prevent or restrict unauthorized access to or exploitation of works. Without authorization, no individual or entity may intentionally circumvent or destroy technological measures, manufacture, import, or provide circumvention devices/components to the public, or provide technical services to facilitate circumvention. Because computer software constitutes protected copyrightable works, doing any of these constitutes infringement, requiring cessation of infringement and compensation for actual damages or illegal gains (or statutory licensing fees; punitive damages of 1 to 5 times apply for willful, serious infringement). If public interest is harmed, copyright administrative authorities may confiscate illegal earnings and impose fines between 1 and 5 times illegal turnover (or up to 250,000 RMB if under 50,000 RMB). Under criminal law, Criminal Law Amendment (XI) incorporated "intentionally circumventing or destroying technological protection measures" into Article 217 (crime of copyright infringement), provided it is done for commercial profit. Illegal gains >=30,000 RMB or illegal business turnover >=50,000 RMB carry up to 3 years' imprisonment plus fines; tenfold thresholds (>=300,000 RMB or >=500,000 RMB) carry 3 to 10 years' imprisonment plus fines. Knowingly providing devices, components, or services primarily used to circumvent measures faces identical penalties. Official Case 1: From March 2019 to July 2022, Liu produced hardware "dongles" designed to circumvent software technological measures, paired them with copied pirated software, and sold them for total illegal turnover of 1.06 million RMB. Shanghai No. 3 Intermediate People's Court convicted him of copyright infringement under the special circumstances clause in China's first "circumvention of technical measures" criminal copyright case following Amendment XI; three defendants received 1 to 3.2 years' imprisonment with fines up to 700,000 RMB. Official Case 2: Medical equipment technician Liu purchased 50 cracked dongles in a QQ group for 80,000 RMB and resold them online for several thousand RMB each to bypass device authentication for diagnostic maintenance software; Shanghai Putuo District Court sentenced him to 1 year and 2 months' imprisonment (suspended) with an 80,000 RMB fine. Official Case 3: In Xuzhou, Li and others commissioned custom jailbreak firmware and manufactured modchips for video game consoles with illegal business turnover exceeding 39 million RMB. In November 2024, 10 individuals were sentenced to prison terms ranging from 2.5 to 3.5 years with fines between 1.5 million and 11 million RMB.

Note

Beneficiary is yourself. The Copyright Law provides narrow statutory exemptions: testing computer and network security performance, encryption research, and reverse engineering software for interoperability may circumvent technical measures; however, the statute explicitly prohibits distributing or providing circumvention tools, devices, or components to others. Private study is permissible; public publishing or commercial sale is illegal. Distributing free crack patches without commercial intent does not meet the criminal "for profit" threshold, but constitutes actionable civil tort liability subject to cease-and-desist orders and damage claims. Civil litigation takes at least 6 months with unrecoverable legal fees. Distributing complete cracked software online triggers criminal liability for unauthorized distribution of copyrighted works (see Chapter 9, Rule 24). Video game cheat plugins bypassing anti-cheat mechanisms are covered in Chapter 11, Rule 2.

Using DDoS traffic to knock offline someone's website, server, or game constitutes the crime of sabotaging computer information systems. Punishments range up to 5 years for serious consequences and 5+ years for especially serious consequences. Customers paying platforms to launch attacks are prosecuted as joint criminal co-conspirators. In court precedents, DDoS platform operators running paid memberships received 10 months to 5.5 years in prison.

Cost

Zero financial expense. A distributed denial-of-service (DDoS) attack overwhelms target servers by directing massive coordinated bot traffic. The cost is walking away from illicit per-attack or traffic subscription businesses, and maintaining emotional restraint during heated in-game disputes or business rivalries. Resolve conflicts via platform reporting, arbitration, or police complaints rather than purchasing booter attacks.

Benefit

Under Article 286 of the Criminal Law, interfering with computer information system functions resulting in system failure carries fixed-term imprisonment or criminal detention of up to 5 years for "serious consequences," and >=5 years for "especially serious consequences." Courts categorize DDoS flooding as statutory system interference. "Serious consequences" are met if: (1) primary software/hardware of >=10 systems fails; (2) illegal income >=5,000 RMB or direct economic losses >=10,000 RMB; or (3) systems serving >=10,000 users remain down cumulatively for >=1 hour. Fivefold thresholds qualify as "especially serious." Knowingly providing attack scripts, malware tools, server hosting, or technical support to attackers constitutes joint criminal complicity once illegal gains reach >=5,000 RMB or tools are supplied to >=10 persons. Providing tools specifically designed for system intrusion or unauthorized control carries up to 3 years' imprisonment if provided to >=20 person-sessions or illegal gains reach >=5,000 RMB (Article 285). Sub-criminal disruptions result in up to 5 days' administrative detention (or 5 to 15 days for aggravated circumstances) under the Public Security Administration Punishments Law. Official Case 1 (Guiding Case No. 69): In early 2017, Yao and others were hired to form the overseas "Dark Night Syndicate," amassing server infrastructure to launch trojan-controlled DDoS barrages against three gaming companies hosted on a major cloud provider, knocking servers offline and causing 40,000+ RMB in emergency repair costs. In June 2018, Shenzhen Nanshan Court sentenced 11 defendants to 1 to 2 years for sabotaging computer information systems. Official Case 2: Tang and Wang operated a commercial DDoS web booter in March 2017 offering paid tiers and attack queues, targeting 80+ IP addresses. Nantong Haimen Court sentenced operators to prison terms between 10 months and 5.5 years. A commercial customer, Zhang, who placed over 100 DDoS attack orders against 11 rival company IPs to suppress competition, was convicted as a principal co-conspirator. Official Case 3: Wang operated a DDoS portal selling attack packages labeled Bronze, Silver, Gold, and Diamond tiers. Beijing Haidian District Court sentenced him to 1 year's imprisonment with a 50,000 RMB fine for the crime of illegally utilizing an information network.

Note

Beneficiary is yourself. These illicit services market themselves as "stress testing tools." Legitimate stress testing applies strictly to your own systems or third-party architectures where you possess explicit, signed written authorization. Penetrating or testing unapproved systems violates criminal standards (see Chapter 11, Rule 9). Judicial prosecution charges vary between jurisdictions: Haimen prosecuted booter operators for sabotaging computer information systems (sentences up to 5.5 years), whereas Haidian applied illegal utilization of an information network (1-year sentence); Supreme People's Court case guidance standardizes this conduct under Article 286. In Guiding Case No. 69, targeted platforms filed police reports, and public security collaborated with CNCERT/CC Guangdong Branch to trace 14 master command servers, corroborating server leases via chat logs and banking trails. Selling trojans to hijack third-party computers into botnets is addressed in Chapter 11, Rule 8.