Cyberspace Administration of China

Structure

The Cyberspace Administration of China and the Office of the Central Cyberspace Affairs Commission of the CCP, its executive arm, are "one institution with two names." The CAC is involved in the formulation and implementation of policy on a variety of issues related to the internet in China. It is under direct jurisdiction of the Central Cyberspace Affairs Commission, a party institution subordinate to the CCP Central Committee. The CAC itself is listed as an institution directly under the CCP Central Committee. The Director of both the state and party institutions is Zhuang Rongwen, who serves concurrently as a Deputy Head of the CCP's Central Committee Publicity Department. The CAC has close ties with the CCP Publicity Department; all CAC directors have been deputy heads of the Publicity Department.

As of 2015, the CAC includes the following departments: an Internet Security Emergency Command Center, an Agency Service Center, and an China Internet Illegal Information Reporting Center. The China Cyberspace Research Institute sits under the CAC. Unlike most other Chinese administrative agencies, the CAC does not regularly publish information about its organizational structure, structure, budget, duties as well as its personnel arrangements, except for brief biographies of its director and deputy directors. Many of the CAC's regulatory functions are delegated to the China Electronic Technology Standardization Institute. The institute tests cybersecurity compliance and data protection.

The CAC has authority over the China Internet Investment Fund, which has golden share ownership stakes in technology firms such as ByteDance, Weibo Corporation, SenseTime, and Kuaishou. The CAC additionally organizes the World Internet Conference.

Directors

Role

The CAC is the national internet regulation agency in China. It is responsible for the content management and law enforcement of the Internet in China. Its functions include rulemaking, administrative licensing and punishment activities. It issues and enforces rules about online content and regulates cybersecurity, data security, and privacy. It oversees the entities that manage the global internet addressing system (DNS) in China.

The CAC implements information-dissemination guidelines and policies, regulates internet information content and management, supervises network news businesses, and investigates illegal or non-regulatory compliant websites. The CAC maintains censorship functions, including issuing directives to media companies in China. After a campaign to arrest almost 200 lawyers and activists in China, the CAC published a directive saying that "All websites must, without exception, use as the standard official and authoritative media reports with regards to the detention of trouble-making lawyers by the relevant departments." The CAC has also been given the responsibility for reviewing the security of devices made by foreign countries.

Since its founding in 2011, CAC had the authority to issue punitive orders, including imposing fines, license revocations, and business closures. The initial powers and legal basis of the CAC came from a 2014 authorization by the State Council. According to the Cybersecurity Law passed in 2016, "state cybersecurity and information departments", generally regarded to refer to the CAC, have the authority to plan and coordinate cybersecurity and related regulation with other regulatory agencies with overlapping or complementary jurisdiction. Since 2017, the CAC has also been publishing legally-binding departmental rules (部门规章), issued by State Council administrative agencies. The Data Security Law passed in 2021 tasked CAC with online data security and export of important data, while the Personal Information Protection Law passed in 2021 granted CAC with powers for planning, coordinating and supervising personal information protection work, retaliating its authority over control of personal information overseas.

Due to the CAC's political and regulatory roles, Rogier Creemers at Leiden University argues that it is the world's most powerful digital institution. It serves as the executive arm of the CCP CCAC, has regulatory power over online content, is responsible for protecting personal information and data, and has direct authority over China's DNS registry, the National Computer Network Emergency Response Technical Team/Coordination Center of China, the cybersecurity standardization body TC260, and the Cybersecurity Association of China.

Policies

Internet sovereignty

In 2017, the CAC issued a rule stating that nonpublic capital should not be allowed to invest in internet-based newsgathering. In 2022, the CAC issued measures and guidelines on security assessments for cross-border data transfers as part of an effort to institutionalize data transfer review mechanisms.

In March 2024, China's Provisions on Promoting and Regulating Cross-Border Data Flows, which CAC had issued, became effective. These provisions aim to integrate obligations across the Cybersecurity Law, the Data Security Law, and the Personal Information Protection Law. Among other measures, it in certain circumstances requires a CAC-led review of data exports across China's borders.

Security

CAC monitors China's tiered national cybersecurity alert state. Pursuant to China's 2016 Cybersecurity Law, it initiates cybersecurity reviews of critical information infrastructure operators and internet platform providers.

Censorship

In 2015, the CAC was also responsible for chasing down Internet users and web sites that published "rumors" following an explosion in the port city of Tianjin. Such rumors included claims that blasts killed 1,000 people, or that there was looting, or leadership ructions as a result of the blast. The same year, the CAC debuted a song that Paul Mozur of The New York Times called "a throwback to revolutionary songs glorifying the state." The song included the lines: "Unified with the strength of all living things, Devoted to turning the global village into the most beautiful scene" and "An Internet power: Tell the world that the Chinese Dream is uplifting China." The efforts of the CAC have been linked with a broader push by the Xi Jinping administration, characterized by Xiao Qiang, head of China Digital Times, as a "ferocious assault on civil society."

In 2020, the CAC issued the Provisions on the Governance of the Online Information Content Ecosystem, requiring "online information content service platforms" to create mechanisms that allow them to conduct "real-time inspections, emergency response, and the handling of online rumors". It also says platforms "must not transmit" information deemed "illegal", and "shall prevent and resist the transmission" of "negative" information.

In May 2020, the CAC announced the Operation Qinglang to "clean up" online political and religious content deemed "illegal." In July 2020, the CAC commenced a three-month censorship action on We-Media in China. In December 2020, the CAC removed 105 apps, including that of Tripadvisor, from China's app stores that were deemed "illegal" in a move to "clean up China's internet". A 2020 investigation by ProPublica and The New York Times found that CAC systematically placed censorship restrictions on Chinese media outlets and social media to avoid mentions of the COVID-19 outbreak, mentions of Li Wenliang, and "activated legions of fake online commenters to flood social sites with distracting chatter".

In 2021, CAC launched a hotline to report online comments against the Chinese Communist Party, including comments which it deemed historical nihilism. In 2022, CAC published rules that mandate that all online comments must be pre-reviewed before being published. During the 2022 COVID-19 protests in China, the CAC directed companies such as Tencent and ByteDance to intensify their censorship efforts. In January 2023, CAC ordered any content displaying "gloomy emotions" to be censored during Lunar New Year celebrations as part of its "Spring Festival internet environment rectification" campaign. In December 2023, CAC launched a crackdown on content "spreading wrong views on marriage". In September 2025, CAC launched a campaign to curb content about "negative outlooks on life" such as "lying flat." In February 2026, CAC mandated that social media platforms censor content deemed as spreading "fear of marriage" or "anxiety about childbirth."

Propaganda

In March 2024, CAC stated that the country's media outlets must create "positive propaganda" (Chinese: 正面宣传) about Chinese achievements.

Artificial intelligence

In April 2023, the Cyberspace Administration of China issued draft measures stating that tech companies will be obligated to ensure AI-generated content upholds the ideology of the CCP such as Core Socialist Values, avoids discrimination, respects intellectual property rights, and safeguards user data. Under these draft measures, companies bear legal responsibility for training data and content generated through their platforms. In July 2023, CAC announced a licensing requirement for generative AI systems. Before releasing a large language model to the public, companies must seek approval from the CAC to certify that the model refuses to answer certain questions relating to political ideology and criticism of the CCP. In May 2024, CAC announced that it rolled out a large language model trained on Xi Jinping Thought.

In April 2026, the Cyberspace Administration of China issued draft regulations on AI-generated "digital humans." The proposal requires labeling of AI-generated content, restricts certain AI services for minors, and bans unauthorized deepfakes of real individuals.

International cooperation

Since at least 2017, CAC has cooperated with Roskomnadzor, Russia's principal internet regulator and censor.

Cyber attacks

The CAC has been accused of assisting in cyber attacks against visitors to Chinese websites. The anti-censorship group GreatFire.org provided data and reports showing man-in-the-middle attacks against major foreign web services, including iCloud, Yahoo, Microsoft, and Google. The attack would have required the ability to "tap into the backbone of the Chinese Internet".

Gibson Research Corporation attributed some of the attacks against GitHub to the CAC's operations. In the attack, ads hosted on Baidu were able to leverage computers visiting from outside China, redirecting their traffic to overload the servers of GitHub. "The tampering takes places someplace between when the traffic enters China and when it hits Baidu's servers," Gibson wrote. "This is consistent with previous malicious actions and points to the Cyberspace Administration of China (CAC) being directly involved..."

Online access for minors

In November 2019, CAC imposed a curfew on online gaming for minors. The restrictions included banning children under 18 from gaming between 10 p.m and 8 a.m. In addition to that, these children were restricted to only 90 minutes of online gaming on weekdays and 3 hours on weekends and holidays. Extra restrictions were imposed on spending where 8 to 16 year old gamers were allowed to spend 200 yuan (£22, $29) per month while 16 to 18 year olds were allowed only 400 yuan per month.

In August 2023, CAC proposed regulations to curb perceived internet addiction on minors. These regulations would limit minors between the ages of 16 and 18 to only 2 hours of mobile usage per day although they can be bypassed with permission from parents. Children under the age of 18 will be restricted from accessing the internet between 10 p.m and 6 a.m whereas children under age 8 will be allowed only 8 minutes a day. CAC says that online platforms will be responsible for the execution of the law if passed, although the specific penalties were not disclosed in the event of failure to comply.

In 2025, the Cyberspace Administration of China issued draft rules for categorizing online information that might affect minors. Under Article 10 of the draft, online goods and service providers must comply with standards for content that may harm minors' physical or mental health. Providers must avoid placing such information in prominent promotional positions and must label or manage it according to the rules.

Trolling and other online behaviors deemed harmful

In 2020, the Xiao Zhan/227 incident, a conflict among online fan communities arising from a slash fiction novel posted on the fan fiction website Archive of Our Own, resulted in public attention and scrutiny from policymakers on the issue of hostile online communication. CAC stated in July 2020 that it would "pay close attention to fans' blind idolization of celebrities and the prevalence of fan conflicts." The CAC's Qinglang Xingdong ("Sweep-Up Campaign") began in June 2021 and sought to clean up harmful actions in fandoms such as fan wars. CAC initiated a series of policies and campaigns against "resentment and abuse, upvoting/downvoting and trolling, disinformation and name-calling, doxing, and privacy violations of online fandom communities." Major Chinese social media platforms revised their policies accordingly.