The Cyberspace Administration of China (CAC)¹ recently opened another round of public consultation on the Regulations on the Administration of Internet Information Services (Draft Amendment for Comment)² (hereafter ’the Regulations’), and several of the revised provisions inside it have got a lot of people worried — particularly the language around ‘penetrating or circumventing technical measures’ and ‘information lawfully blocked’. Almost overnight, cries of ‘circumvention is now flatly illegal’ and ‘here comes the blanket ban’ started flooding the internet.

Discussions about ‘blanket bans’ and ‘whitelisting’ crop up online almost every year, and if you can’t quite gauge how big an audience this line of argument has, just look back at how the ‘ban on exporting personal data’ provision was interpreted a few years ago. Right then, let’s have a proper look at whether this round of the Regulations really is ‘an escalation in control’, or just a bit of routine technical legislative tidying up.

Article 26: Does it explicitly make ‘circumvention’ illegal?

Article 26 No organisation or individual shall carry out any of the following acts that disrupt the order of internet information services:

(1) Publishing, deleting, blocking, disconnecting links to, replacing, demoting, or algorithmically recommending information, or providing such services to others;

(2) Falsely registering or registering internet accounts in bulk, or illegally hoarding or trading internet accounts;

(3) Manipulating or using multiple internet accounts in bulk to publish information containing content prohibited by laws and administrative regulations and other harmful information, engaging in false clicks, votes, rankings, leaderboards, comments, transactions, or reviews, fabricating traffic, hijacking traffic, manufacturing false public opinion hotspots, or manipulating leaderboards and trending topics and other key elements;

(4) Carrying out unlawful acts of penetrating or circumventing the technical measures of relevant state institutions;

(5) Other acts prohibited by laws and administrative regulations.

Internet information service providers shall adopt measures such as monitoring for abnormal data and conducting manual review, and strengthen the prevention and monitoring of the acts specified in the preceding paragraph.

At first glance this looks genuinely alarming — doesn’t this explicitly make circumvention illegal? The drafting of laws and regulations demands close parsing of every word; almost every legal provision goes through repeated scrutiny and wording. Read that clause again, slowly:

Carrying out unlawful acts of penetrating or circumventing the technical measures of relevant state institutions

‘Unlawful’ is the modifier here, qualifying the act of ‘penetrating or circumventing the technical measures of relevant state institutions’. In other words, not all penetration or circumvention is prohibited — only the ‘unlawful’ kind is.

What counts as ‘unlawful’

So what does ‘unlawful’ (违法) actually mean here?

The NPC Standing Committee’s Legislative Affairs Commission’s Legislative Technical Specifications gives a clear definition of the concept of ‘unlawful’: ‘unlawful’ generally refers to conduct that violates a mandatory rule of law³. In other words, to determine that an act is ‘unlawful’, there has to be a clear, mandatory legal rule that it actually violates — you can’t just assert it out of thin air. Here are two reference examples given in that specification:

• Example 1: If an inspected unit or individual refuses to stop unlawful conduct, causing serious soil erosion, and this is reported to and approved by the water administration authority, the tools, construction machinery, equipment, etc. used to carry out the unlawful conduct may be seized or impounded. (Article 43, Soil and Water Conservation Law)
• Example 2: Where a villagers’ committee fails to promptly publicise matters that should be publicised, or the matters publicised are untrue, villagers have the right to report this to the township, ethnic township, or town government, or to the county-level government and its relevant competent department, and the relevant government or competent department shall be responsible for investigating and verifying the matter and ordering publication in accordance with the law; where unlawful conduct is confirmed upon investigation, the relevant persons shall bear responsibility in accordance with the law. (Article 31, Organic Law of Villagers’ Committees)

If that’s still not clicking, it helps to compare ‘unlawful’ (违法) with ‘illegal’ (非法). The Legislative Technical Specifications explains ‘illegal’ as: usually also a form of unlawfulness, but the emphasis is on conduct that lacks a legal basis. What does that mean? It doesn’t mean ’there’s no law that permits you to do this’ — it means: this type of conduct inherently requires some basis, permit, qualification, authorisation, or lawful source under the law, and the person carrying it out simply doesn’t have it. Take ‘practising medicine illegally’ (非法行医) — you’re supposed to hold a medical practitioner’s licence, but you don’t, so you’re practising medicine illegally. Apply the same structure to ‘practising medicine unlawfully’ (违法行医), and it starts to sound like you do hold a licence, but you’re practising in the wrong way — which is a much less common phrasing.

What this specification and its examples show is that determining whether an act is ‘unlawful’ requires a clear, pre-existing legal basis. The trouble is, where exactly would you go looking for one? As everyone knows, the GFW blocks Google, YouTube, Twitter, and so on, but that blocking has never once been backed by a court order, a signed administrative document, or even so much as an informal, official blocklist⁴. Take our hypothetical lawless everyman Zhang San⁵, who sets up his own ShadowSocks server to access Google, YouTube, Twitter, and the like: for a start, his conduct doesn’t even meet the precondition for the rule to apply — disrupting the order of internet information services — and second, there’s no law or administrative document explicitly blocking or prohibiting access to those sites either. So, in the strict legal sense, Zhang San is not acting ‘unlawfully’.

Which is to say: Article 26(4) simply doesn’t apply to Zhang San, because his conduct fails to meet the precondition of being ‘unlawful’ in the first place.

Who is this clause actually aimed at

This clause sits alongside the following types of conduct:

• Manipulating information publication/deletion/algorithmic recommendation
• Bulk fake account registration
• Fake engagement, fake rankings, fake traffic, fake public sentiment
• Unlawfully penetrating or circumventing the technical measures of relevant state institutions
• Other

The targets of the first three items are pretty clear — black-market operators, astroturfing outfits, SEO/GEO manipulation, that sort of thing. Item (4) sits alongside them, and in that context it implies the target is organised, commercialised conduct that disrupts the order of information services — not Zhang San having a look at Google Scholar from his living room.

Plausible targets:

• Commercial proxy providers⁶ and VPN services (operating telecoms business and circumvention technical measures without a licence — this used to sit in a grey area under the guise of ‘accelerators’, and in theory can now be caught here too)
• Anyone using circumvention tools for overseas public-opinion manipulation, cross-border fraud, or gambling-referral schemes
• Anyone helping a lawfully shut-down website come back to life via technical means
• Attacks that breach the security measures of government or corporate intranets and private networks

Article 30: Strangling the entire grey-market supply chain?

Article 30 Where anyone knowingly aware that another person is violating this Regulation by carrying out any of the following acts, no organisation or individual shall provide that person with support, assistance, or other help in the form of data, technology, programs, tools, software, advertising, services, payment settlement, or otherwise:

(1) Producing, copying, publishing, or disseminating information that violates Article 24 or Article 25, Paragraphs 1 and 2 of this Regulation;

(2) Disrupting the order of internet information services in violation of Article 26, Paragraph 1 of this Regulation;

(3) Enabling another person to obtain or disseminate information lawfully blocked.

This one looks alarming too — does merely helping someone else see lawfully blocked information at any point in the chain now count as unlawful? Wouldn’t that sweep in proxy resellers, risky payment processors, review/promotion channels, and even the developers of circumvention cores, all under the jurisdiction of this one clause?

What counts as ‘information lawfully blocked’

In practice, ’lawful blocking’ tends to fall into a few categories: court rulings, administrative penalties, police case-handling, and ministry-led special operations.

Court rulings are most common in the intellectual property field. A rights holder sues a pirate website, the court finds infringement, and orders the ISP to block the domain. There’s a judgment, a case number, a defendant, and an effective date.

Then there’s administrative penalties — say, the telecoms regulator issues an administrative penalty decision against an unregistered⁷ website, orders it to rectify, and when it refuses to comply, notifies the access provider to stop service. There’s a penalty decision number, proof of service, a citation of legal basis, and notice of remedies (e.g. ‘if dissatisfied with this penalty decision, you may apply for administrative reconsideration to XX authority within sixty days of receiving this decision, or file an administrative lawsuit with the XX People’s Court within six months’).

Police case-handling is easy enough to picture — think anti-vice sweeps: for websites involved in fraud, gambling, or pornography, the police can open an investigation and require ISPs to cooperate in cutting off access. This usually comes with a formal case-opening decision and a written notice of assistance sent to the operator, which the operator keeps on file.

Ministry-led special operations are a slightly different case — for example, the National Copyright Administration’s annual ‘Sword Net’ campaign, which publishes a list of infringing websites each year and instructs ISPs to block them. There’s a public notice document, a list of websites, and a cited legal basis. The procedure is streamlined, but there’s still a paper trail from an actual government department.

Does helping someone else ‘circumvent the wall’ count as helping them obtain or disseminate lawfully blocked information?

The logic here mirrors what came before. In practice, there is no publicly available administrative document or court order anywhere that says anything like ‘pursuant to Article X of Law Y, it is hereby decided that access to Google/YouTube/Telegram shall be blocked’. You won’t find a stamped decision, you won’t find the name of the specific administrative body that made the blocking decision, you won’t find a stated duration for the block, and you won’t find any avenue for appeal.

Legally speaking, the GFW’s blocking of overseas websites has always been a factual act rather than a legal act. It exists, it functions, but it has never gone through the procedure of ‘issuing an administrative decision → notifying the party concerned → allowing appeal’. It’s not hard to see that the GFW’s blocking of platforms like Google and Twitter isn’t the ’lawful blocking’ this clause is talking about.

At this point someone might ask: Article 8 requires an ICP licence⁸ to provide internet information services within Mainland China → Google doesn’t have an ICP licence → Google is therefore providing services unlawfully → blocking an unlawful service = lawful blocking — doesn’t that add up to lawful blocking after all? It sounds plausible, but it runs into serious trouble on closer inspection.

First, the question of jurisdiction. Article 2 refers to ’engaging in internet information services within the People’s Republic of China’. Google’s servers aren’t in China, and neither is the company (it retained some R&D staff after exiting the Chinese market years ago, but that R&D arm doesn’t run any of Google’s public-facing services). Google hasn’t proactively conducted business within Chinese territory — a Chinese user visiting Google, and Google proactively conducting business within China, are two entirely different things. Article 92 does say that ‘where an organisation or individual outside the People’s Republic of China provides internet information services to the People’s Republic of China, it shall comply with the law’ — but that’s just a statement of obligation, not an automatic grant of jurisdiction. You’d first have to establish that it is ‘providing services within Chinese territory’, and that determination itself requires a formal administrative process.

Second, failing to obtain an ICP licence doesn’t carry ‘blocking’ as its legal consequence. Article 74 is quite clear: for anyone providing internet information services without a licence — ’the telecoms authority shall order rectification; where rectification is refused, it shall order suspension of business for rectification.’ Note the legal consequences here are ‘ordering rectification’ and ‘ordering suspension of business for rectification’, not blocking. And these penalty measures presuppose that you can actually serve notice and enforce them — that works fine against a domestic entity, but how do you ‘order’ a foreign one to do anything? You don’t even have an address to serve the notice to — are you going to mail the legal papers to Mountain View?

Third, Article 67 has no reach over overseas websites that never held a licence in the first place. ‘Where a licence or approval number is revoked, rescinded, or cancelled by the telecoms authority, the telecoms authority shall notify the relevant internet access service provider and domain name resolution service provider to stop providing services to it.’ This clause comes closest to describing lawful blocking — notifying an ISP to cut off service. But it applies to entities that have been ‘revoked, rescinded, or cancelled’ — you have to have held a licence first, and then had it taken away, for this clause to be triggered at all. It simply has no reach over an overseas website that has never held a licence in the first place.

In fact, you can work this out in reverse just by looking at the current state of the internet since the filing system came into force. We know that if ’lawful blocking’ were applied uniformly to every unregistered website, the effect would be identical to a whitelisting system — only registered websites could be accessed, and everything else would be blocked outright. But the reality is that the domestic internet is clearly not in a whitelist state — plenty of unregistered overseas websites remain perfectly accessible. From this we can conclude that the GFW’s blocking of specific websites isn’t ’lawful blocking’ in the sense the clause intends. And since information obtained through circumvention doesn’t count as ’lawfully blocked information’, Article 30(3) simply doesn’t apply either.

Article 15: Officially signing the death warrant for dedicated-line proxy resellers?

Article 15 The state implements a filing management system for the allocation and use of internet protocol addresses. IP address allocation bodies shall promptly report IP address information to the telecoms authority for filing.

Before providing access services, internet access service providers shall verify the corresponding IP address filing information, and shall not provide services to IP addresses that are unregistered or falsely registered.

This kind of regulatory provision targeting IDCs and ISPs has been around for a long time already, and proxy resellers have carried on operating regardless, under the guise of ‘accelerators’ or by piggybacking on other licensed entities. Exactly when and how vigorously it gets enforced is something the Ministry of Industry and Information Technology (MIIT) adjusts on the fly, depending on domestic political and economic needs. The recent wave of mass line-cutting happens to coincide with a leadership reshuffle at MIIT — whether this level of enforcement is a ’new broom sweeps clean’⁹ style temporary campaign, or signals a longer-term tightening, remains to be seen.

Penalties and other details

Article 84 Violations of Article 26, Article 30, Article 32, Article 48, or Article 49 of this Regulation shall be punished in accordance with the relevant laws and administrative regulations. Where laws and administrative regulations do not so provide, the cyberspace, telecoms, public security, and other relevant competent authorities shall, according to their duties, order rectification within a specified period, and may additionally impose a fine of no less than RMB 100,000 and no more than RMB 1,000,000; where rectification is refused or the circumstances are serious, a fine of no less than RMB 1,000,000 and no more than RMB 5,000,000 shall be imposed, and suspension of relevant business or suspension of business for rectification may additionally be ordered.

Note that the fine here starts at RMB 100,000, caps out at RMB 5,000,000, and can come with an order to ‘suspend relevant business or suspend business for rectification’ — this wording is clearly pointed at organisations and commercialised entities, not individual users. An individual using a proxy at home to look at Google doesn’t involve any ‘business’ or need for ‘rectification’ — and the way the penalty clause is designed backs this up: it’s aimed at organised commercial conduct, not ordinary internet users.

What’s more, the penalty clause only applies where Article 26 or Article 30 has actually been violated — and as already analysed above, an individual’s circumvention conduct doesn’t satisfy the elements required to trigger either clause. However severe the penalty, if the elements aren’t met, it never gets to you in the first place.

How ‘circumvention’ actually gets punished in practice

The Sword of Damocles

The analysis so far has looked at this purely from the angle of legal text: an individual circumventing the wall doesn’t meet the elements required under the new Regulation’s relevant clauses. But legal text is one thing, and real-world enforcement is another.

In fact, administrative penalties against individuals using VPNs have existed all along — just not under this new Regulation, but under Article 6 of the Interim Provisions on the Management of International Connections to Computer Information Networks¹⁰, enacted back in 1997 — ‘any direct international connection of a computer information network must use the international access channels provided by the state public telecommunications network under the Ministry of Posts and Telecommunications’ — along with the penalties set out in Article 14: a warning, confiscation of unlawful gains, a fine of up to RMB 5,000 for individuals, and up to RMB 15,000 for organisations.

This provision has been sitting on the books for nearly thirty years, dormant for most of that time. But it’s never been repealed, which means enforcement authorities can choose to activate it at any moment — and the timing, intensity, and choice of target depend entirely on the political climate and local enforcement appetite at the time.

Worth flagging: the concept of an ‘international access channel’ is itself vaguely defined. The Interim Provisions require use of ’the international access channel provided by the state public telecommunications network’, but many dedicated-line proxy resellers buy precisely the IPLC (International Private Leased Circuit) or IEPL (International Ethernet Private Line) services run by the three major state carriers — China Telecom, China Unicom, and China Mobile. These are legitimate international bandwidth products that the three carriers openly sell to corporate customers. If a user accesses overseas networks through a legally purchased carrier international leased line, does that satisfy the requirement of ‘using the international access channel provided by the state public telecommunications network’? The provision offers no answer, and enforcement practice has never settled the question either. This ambiguity only widens the scope for selective enforcement.

Real cases

Based on publicly searchable administrative penalty records¹¹, the number of documented penalty cases involving individuals using VPNs far exceeds what most people would assume. Here are a few well-documented examples:

• Nanxiong, Shaoguan, Guangdong (2019): the party used Lantern to circumvent the wall 487 times in total, and was issued a warning and fined RMB 1,000 by the Nanxiong Public Security Bureau.
• Jinhua, Zhejiang (2020): Decision No. Jingongdong (Cyber Police) Xingfajuezi [2020] No. 00751 — the party was administratively penalised for using an unauthorised international channel.
• Suining, Sichuan (2019): Decision No. Suichuangong (Yong) Xingfajuezi [2019] No. 489 — a similar penalty.
• Somewhere (2025): a party referred to as ‘Xiao Zhang’ was found to have VPN usage records during a network security inspection and was fined RMB 15,000 (the maximum penalty).
• Xiaogan, Hubei (March 2026): the Xiaogan Xinhua Police Station sent more than ten officers in person, and the party was fined RMB 500 for using a VPN.

Almost all of the above cases cite the same legal basis: Articles 6 and 14 of the Interim Provisions on the Management of International Connections to Computer Information Networks.

Problems in enforcement

A few things worth noting stand out from these cases:

Selective enforcement. China’s circumvention-using population is conservatively estimated in the tens of millions¹², while publicly documented penalty cases number only in the dozens. This means the overwhelming majority of people will never be pursued — but anyone could, in theory, be the one who is. Here, the law isn’t functioning as a generally applicable rule so much as a sword hanging over everyone’s heads, and when it falls depends entirely on the will of the enforcer. With economic growth slowing in recent years and fiscal pressure mounting at the local level, the ‘distant-water fishing’¹³ phenomenon that’s emerged in some regions is perhaps the most darkly ironic illustration of this kind of selective enforcement — when you’re determined to convict someone, there’s never a shortage of pretexts. Hand over your ‘unlawful gains’ quietly, and hey, someone’s performance bonus is finally sorted.

Chaotic application of the law. Different regions cite different legal provisions for identical conduct: some rely on Article 6 of the Interim Provisions, others on Article 27 or Article 63 of the Cybersecurity Law, and others still on provisions in the Public Security Administration Punishment Law¹⁴. The same act can receive wildly different legal treatment depending on where it happens, which in itself shows just how inconsistent the standards for applying the law really are. It’s also worth pointing out that China is a civil law jurisdiction rather than a common law one, so court judgments carry no binding precedent — you might be fined RMB 500 for circumventing the wall in Region A, while the exact same conduct in Region B might draw a RMB 15,000 fine, or no action at all, and you have no way to invoke Region B’s inaction as a defence for what happened to you in Region A.

Enforcement action disproportionate to the offence. In the Xiaogan, Hubei case, more than ten officers were sent out to deal with an administrative violation that ultimately drew a RMB 500 fine — this kind of enforcement posture looks a lot more like intimidation than routine administrative management.

Using it as a pretext for other catch-all charges. In some cases, the penalty for circumventing the wall itself is negligible, but the police use it as an entry point to dig further into what the person has been saying on overseas platforms, and then pursue criminal liability under a catch-all charge like ‘picking quarrels and provoking trouble’¹⁵. Circumvention here becomes the pretext for invoking some other catch-all charge — what actually gets punished isn’t the act of circumventing the wall itself, but the person’s speech or political stance, with circumvention providing the excuse.

What you can actually do

After all that, you might be thinking: fine, it doesn’t hold up under the legal text, but there’s still real-world risk — so wasn’t this whole thing pointless?

No — this is a draft for public comment, and right now you have an actual, formally documented channel to participate in the legislative process.

Submit your comments on the draft

The Regulations are currently open for public comment. Under Article 15 of the Regulations on the Procedures for the Formulation of Rules, every citizen has the right to submit comments on a draft for comment. This isn’t a favour being granted to you — it’s a legally established procedure. You can submit your comments formally through the consultation channel published by the CAC — for example, suggesting that the wording around ‘unlawfully penetrating or circumventing’ be given a clearer definition of its elements, or that ’lawfully blocked’ be given a proper procedural definition to prevent the concept from being abused.

Contact your local People’s Congress deputy

Article 41 of the Constitution of the People’s Republic of China:

Citizens of the People’s Republic of China have the right to criticise and make suggestions to any state organ or functionary.

Article 4 of the Law on Deputies to the National People’s Congress and to the People’s Congresses at Various Local Levels of the People’s Republic of China:

Deputies shall maintain close contact with the electors or the electoral units that originally elected them, listen to and reflect the opinions and demands of electors and electoral units, and strive to serve the people.

The district/county-level People’s Congress deputy for your constituency has an obligation to hear your views, and district/county People’s Congress standing committee websites usually publish a list of deputies and their contact details. Find your deputy, give them a call or write them a letter, and tell them:

• that you believe internet legislation should follow the principle of clarity, and that vague provisions shouldn’t become a tool for selective enforcement;
• that you support governing the internet in accordance with the law, but oppose using the language of ‘in accordance with the law’ to mask what is in fact ’no law to rely on’;
• that you’d like to see the concept of ’lawfully blocked’ given a clear procedural definition in law.

Putting core socialist values into practice starts with contacting your People’s Congress deputy.

TL;DR

This is routine technical legislative housekeeping. Carry on living your life as before, weigh your own risks for whatever you choose to do, and nothing to see here, folks.