Platform Economy & Data Regulation

China’s platform-economy posture remains one of normalization: rules before enforcement, infrastructure investment ahead of crackdowns. The latest document batch changes none of that. No new anti-monopoly case, no PIPL penalty, and no new data-security enforcement appears anywhere in these documents. Instead, the most platform-specific action is Hong Kong’s move to license ride-hailing platforms ¹, which is a formalization of a sector, not a prohibition. For readers outside China, the takeaway is unchanged: Chinese jurisdictions are treating platforms as permanent, regulated industries, and the ‘crackdown era’ of 2021 is not returning.

The most consequential mainland rule in train remains the CAC’s draft Provisions on Personal Information Protection by Large Personal Information Processors (大型个人信息处理者个人信息保护规定), issued for public comment in late August 2026 ². The draft operationalizes the PIPL’s ‘large processor’ category by mandating encryption, de-identification, access control and anonymization, and by encouraging use of the national online-identity-authentication public service and personal-information-protection certification. It is a rule-making exercise: it sets compliance obligations before enforcement, and nothing in this batch suggests the CAC is about to turn the rule into a prosecution wave.

The supportive half of the policy mix is if anything more visible. Shanghai’s ‘15th Five-Year’ Strategic Emerging Industries Plan, published 26 August 2026, targets 2.1 trillion yuan in strategic-emerging-industry value-added by 2030 and makes AI—large models, agents, scientific intelligence, embodied intelligence and the smart-computing industry chain—one of three ‘leading industries’ ³. Liaoning, for its part, will host the 2026 Global Industrial Internet Conference in Shenyang on 8-10 September, with ‘AI + industrial Internet’ as its theme and industrial large models, embodied intelligence and data-element marketization on the agenda ⁴. These are promotional and capacity-building moves, not regulatory tightening.

Provincial implementation continues to mix capacity and governance. Jiangsu held its ‘strong cyber province’ work conference in Nanjing on 27 August, reviewing progress under the national Network Power Strategy and highlighting network-data-security, AI development and market-based allocation of data elements—without announcing new enforcement measures ⁵. Guizhou, the flagship data-infrastructure province, reports that 169.94 EFLOPS of its 176 EFLOPS total computing power is in active use, a 96% utilization rate, and that over 90% of that capacity is rented by users outside the province ⁶. This is the physical backbone of the platforms and AI models Beijing is simultaneously regulating by rule.

Hong Kong’s ride-hailing licensing initiative is the sharpest platform-specific regulatory action in the batch, but its direction is formalization. On 28 August, the Transport Department invited platform companies to apply for ride-hailing service licenses; the Transport Advisory Committee endorsed entry requirements covering ride-hailing booking-management technology, platform operating experience, financial proof and capital investment, and said a government data-management system will monitor platforms and enable dynamic assessment ¹. This is a licensing-and-monitoring regime of the kind mainland regulators have built for ride-hailing since 2016. It should be read as Hong Kong aligning with the mainland’s rules-first approach, even though the SAR sets its own detailed standards.

The remaining items are noise for this topic. Macao’s discontinuation of the Municipal Affairs Bureau’s supplier database and service platform on 1 September, after launching a unified Public Procurement Website under the new Public Procurement Law, is a government e-procurement consolidation ⁷. The National Financial Regulatory Administration’s approval for Bank of Shanghai to absorb BOS International as a wholly owned subsidiary—ending five consecutive loss-making years, cumulative HK$2.557 billion—is a cross-border financial restructuring with no bearing on internet-platform anti-monopoly or PIPL enforcement ⁸. The absence of any escalation in this batch is itself the signal.

The open question that matters for readers remains how the CAC will define ‘large personal information processor’ in the final rule, because that threshold determines which companies bear the new compliance costs. For now, the regulatory line is stable: rules before enforcement, provincial investment in computing and cyber governance, and subnational/SAR licensing regimes for platform services all point in the same direction—platforms are permanent, regulated industries, not targets of a campaign.