Key Facts
Overview
China's Cybersecurity Law establishes the legal framework for cybersecurity obligations, forming one of three pillars alongside the PIPL and DSL. The January 2026 amendments represent the first major overhaul since 2017, significantly increasing penalties and broadening extraterritorial enforcement.
What This Means for Your Website
- Network operators must verify user identity
- Critical information infrastructure operators must store data locally in China
- Security assessments are required for cross-border data transfers
- The 2026 amendments increase penalties and broaden extraterritorial reach
- Cookie-specific consent requirements are handled by the PIPL, not the CSL
Key Requirements
The CAC and relevant departments enforce the CSL. The 2026 amendments significantly increased penalties beyond the original 2017 framework and expanded enforcement to cover broader cybersecurity matters beyond critical infrastructure. Data localization requirements apply to critical information infrastructure operators.
How ConsentStack Handles This
ConsentStack helps websites comply with the CSL's framework by managing consent requirements in coordination with PIPL obligations, particularly around data localization and cross-border transfer considerations.
Penalties
Significantly increased under January 2026 amendments with expanded extraterritorial reach.
Key Requirements
- Network operators must verify user identity
- Critical infrastructure operators must store data locally
- Security assessments required for cross-border data transfers
- Mandatory cybersecurity incident reporting
- Network security protection obligations
Notable Provisions
- January 2026 amendments — first major overhaul since 2017
- Increased penalties and broadened extraterritorial enforcement
- Works alongside PIPL and DSL in tri-pillar framework
Other Asia Pacific Regulations
Frequently Asked Questions
What changed in the CSL in 2026?
The January 2026 amendments represent the first major overhaul since 2017, significantly increasing penalties and broadening extraterritorial enforcement.
Does the CSL require cookie consent?
No. Cookie-specific consent requirements are addressed by the PIPL. The CSL focuses on cybersecurity obligations, network security, and data localization.
What is the relationship between CSL, PIPL, and DSL?
They form China's tri-pillar data governance framework: CSL (cybersecurity), PIPL (personal data), and DSL (data security).
Stay compliant with China CSL
ConsentStack helps you implement Opt-in consent for China automatically.