Last night, the Cyberspace Administration of China (CAC) issued an announcement clearly requiring that all entities processing minors’ personal information must conduct annual compliance audits concerning the protection of minors’ personal information, and complete submission to the competent municipal-level cyberspace administration authorities by the end of January 2026.
As an industry in which minor users are highly concentrated and data-processing scenarios are complex and diverse, does the game industry need to conduct minors’ personal information compliance audits? What issues require particular attention?
Why Game Companies Must Attach Importance to Minors’ Personal Information Compliance Audits
The game industry is characterized by a high concentration of minor users and complex data-processing scenarios. Compliance audits for minors’ personal information are no longer an “additional task,” but rather a core compliance obligation directly affecting a company’s survival and development.
1. Minors’ Personal Information Audits Will Become a Routine Compliance Requirement for Game Companies
Regulations such as the Regulation on the Protection of Minors in Cyberspace and the Measures for the Administration of Personal Information Compliance Audits have clearly stipulated that entities processing minors’ personal information shall, either independently or by engaging professional institutions, conduct annual compliance audits of their processing activities and timely report the audit results to cyberspace administration authorities and other relevant regulators.
In practice, the user base of game products inherently includes a large number of minors. The entire lifecycle of game products—including registration and login, real-name authentication, in-game interactions, and recharge and consumption—inevitably involves the processing of minors’ personal information. This means that game companies have, in substance, already become “processors of minors’ personal information.” Accordingly, compliance audits concerning minors’ personal information have become an unavoidable compliance requirement for game companies.
2. Preventing Increasingly Severe Personal Information Regulatory Penalties
Regulatory authorities continue to place heightened emphasis on personal information protection. Pursuant to Article 66 of the Personal Information Protection Law, illegal processing of personal information may result in fines of up to 5% of annual turnover or RMB 50 million, and regulators may also order the suspension of relevant business operations or business rectification.
Given that a certain proportion of game users are minors, any compliance loopholes in the processing of minors’ personal information may not only trigger regulatory penalties, but may also directly affect the normal operation of game products. For game companies, conducting minors’ personal information compliance audits in advance can effectively reduce compliance risks and ensure stable business operations.
3. Helping Game Companies Build a Responsible Social Image and Consolidate User Trust
The protection of minors’ personal information is a focal point of public opinion, and the game industry is particularly subject to public scrutiny. Once incidents such as data leaks or illegal collection of minors’ personal information occur, they are highly likely to provoke resistance from parents and public opinion crises, directly undermining brand reputation.
Proactively completing compliance audits not only demonstrates a company’s compliance capabilities to regulators, but also sends a clear signal of compliant operations to parents and users. This is conducive to reputation building and the establishment of long-term user trust.
4. Addressing Compliance Challenges Arising from the Globalization of Game Products and Facilitating Overseas Expansion
As game companies accelerate overseas expansion, foreign markets impose equally stringent requirements on the protection of minors’ personal information. For example, the EU GDPR requires explicit consent or authorization from guardians for the processing of children’s data, and similar rules exist in the United States, Southeast Asia, Japan, and South Korea.
Domestic compliance audits constitute a baseline threshold for overseas expansion. Only by first identifying and rectifying risks through domestic audits can companies adapt to varying compliance requirements across jurisdictions, avoid overseas delisting or massive fines, and ensure the smooth advancement of global strategies.
How Should Game Companies Conduct Minors’ Personal Information Compliance Audit Reporting?
(I) Selection of the Compliance Audit Entity
There are two options for game companies to conduct minors’ personal information compliance audits:
(1) self-audits conducted by internal teams; or
(2) audits conducted by external professional compliance institutions.
We recommend engaging external professional institutions, for the following reasons:
1. Independence of External Audit Institutions Enhances Regulatory Recognition
Audit conclusions issued by third-party professional institutions inherently possess independence and objectivity, and their audit reports are more consistent with regulators’ expectations regarding audit independence and impartiality.
2. Combined Legal and Technical Expertise
Minors’ personal information processing scenarios in the game industry are relatively complex and require the integration of legal and technical expertise. Auditors must not only possess legal knowledge, but also understand computer systems and data-processing mechanisms.
3. About Kenting Law Firm
Kenting Law Firm has teams specializing in the game industry as well as lawyers with long-term experience providing personal information compliance audit services to leading internet companies. The firm can provide specialized minors’ personal information protection compliance audit services. Game companies with audit needs are welcome to contact us.
(II) Key Focus Areas of Minors’ Personal Information Compliance Audits
Compliance audits may focus on the following aspects:
Scale of Information Processing:
Including the scale of personal information, minors’ personal information, and personal information of minors under the age of fourteen.Scope of Audit Objects:
Websites, mobile applications, mini-programs, and application systems may all be included within the annual audit scope.Audit Conclusions and Rectification Status:
By reference to the Cybersecurity Practice Guide — Requirements for Personal Information Protection Compliance Audits, auditors may organize and review the legality of personal information processing activities, rule formulation, notification and consent mechanisms, and clearly identify audit findings and rectification measures.
(III) Key Points for Reporting Compliance Audit Results
After completing the audit, materials must be submitted strictly in accordance with regulatory requirements, with the following core points:
1. Confirmation of the Reporting Entity
When fulfilling reporting obligations, game companies may adopt appropriate reporting methods based on their operational structures and affiliations:
(1) Group-structured game companies with multiple development studios or branch institutions may have the headquarters centrally coordinate reporting, provided that the report clearly specifies all covered organizational entities.
(2) Where there are multiple affiliated personal information processors related to game operations—such as multiple game subsidiaries within a group, or third-party partners providing data services or outsourced customer support—reporting may be conducted on a consolidated basis, with the covered organizational scope clearly specified.
2. Reporting Materials
(1) 20XX Annual Minors’ Personal Information Protection Compliance Audit Reporting Form
(2) Letter of Commitment
(3) Minors’ Personal Information Protection Compliance Audit Report (if available)
The audit report may be prepared with reference to Appendix C of TC260-PG-20255A Cybersecurity Practice Guide — Requirements for Personal Information Protection Compliance Audits, which provides a template for personal information protection compliance audit reports.
3. Reporting Channels
Audit reports must be submitted through official systems, either by:
(1) directly accessing the Personal Information Protection Business System; or
(2) entering the Personal Information Protection Business System through the “National Cyberspace Administration Government Services Hall” section on the official website of the Cyberspace Administration of China.
Game companies should ensure submission of the previous year’s audit results by the end of January each year, so as to avoid adverse impacts on compliance records due to late submission.
