China's algorithm recommendation rules take effect

Background

Much of what a user sees in an internet information service is chosen by software rather than by an editor. Recommendation systems decide which posts, videos, search results and products reach which people, and they are designed and tuned inside the companies that run them. That makes the criteria behind those choices hard to observe from outside, and it is this layer of decision-making that the rules below set out to address.

What was issued

Four departments — the Cyberspace Administration of China, the Ministry of Industry and Information Technology, the Ministry of Public Security and the State Administration for Market Regulation — jointly released the Provisions on the Administration of Algorithm-Generated Recommendation in Internet Information Services^[1]. The text was adopted at the CAC office meeting on 16 November 2021 and published as Order No. 9, dated 31 December 2021^[2]. It took effect on 1 March 2022^[1][2].

What counts as algorithm recommendation

The provisions define algorithm recommendation technology broadly: generative-synthesis, personalised push, ranking and selection, retrieval and filtering, and scheduling and decision-making algorithms, in each case as used to provide information to users^[1][2]. The definition therefore covers far more than the familiar "you may also like" feed. Any automated process that orders, filters, assembles or allocates information for users falls inside the scope.

Duties placed on providers

Providers are required to establish systems for user registration, information publication review, data security, personal information protection and emergency response^[1]. In other words, the algorithm has to sit inside an ordinary compliance structure rather than stand apart from it: accounts are registered, published material is reviewed, data and personal information are protected, and there is a procedure for emergencies.

The provisions also state that providers must uphold a mainstream value orientation and may not use algorithm recommendation services to spread information prohibited by laws and regulations^[2].

Prohibitions

The text names several practices that are not allowed. Providers may not set algorithm models that induce users to become addicted or to overspend^[1]. They may not enter keywords of illegal or harmful information into user interest profiles, or use those keywords as user tags for pushing information^[1]. And they may not use algorithms to manipulate rankings, search results or trending lists in ways that affect public opinion or evade supervision^[1].

These three bans target different points in a recommendation pipeline: the objective the model optimises for, the profile that describes the user, and the presentation layer where ordered lists become visible. Each of them concerns something that was previously an internal engineering choice.

Legal basis

The provisions are based on the Cybersecurity Law, the Data Security Law, the Personal Information Protection Law and the Measures for the Administration of Internet Information Services^[2]. They therefore do not stand alone: they attach algorithm-level requirements to obligations that already existed for network operators and for handlers of personal data.

Why it matters

The effect is to convert a set of internal technical decisions into matters a provider can be asked to account for. A company that runs a feed, a search box or a trending list now has to be able to describe how it registers users, who reviews what is published, how personal information is handled, what happens in an emergency, and whether its model is built to keep people scrolling or spending. Because the definition of algorithm recommendation is written widely, the rules reach well beyond dedicated recommender systems to the ranking and filtering code that sits inside most information services^[1][2].