China’s New Cybercrime Law: A Threat to Human Rights & Global Reach

Beijing’s draft cybercrime legislation, published January 31, 2026, is drawing sharp criticism from human rights organizations who argue the proposed law significantly expands the Chinese government’s already extensive surveillance capabilities and further restricts online freedoms. The 68-article Draft Law on Cybercrime Prevention and Control aims to consolidate regulations governing telecommunications, the internet, and banking, but critics contend it does so at the expense of fundamental rights. The legislation’s broad scope and vague language raise concerns about its potential to stifle dissent and control information, both within China and increasingly, beyond its borders.

Expanding State Control in the Digital Sphere

The core concern centers on the law’s potential to solidify what Human Rights Watch terms “digital authoritarianism.” Yalkun Uluyol, China researcher at Human Rights Watch, stated the draft law “reflects President Xi Jinping’s broad efforts to restrict digital and physical spaces by allowing state security to expand and tighten social controls, including beyond borders.” The legislation builds upon existing frameworks like the 2016 Cybersecurity Law and the 2021 Data Security Law, but goes further in formalizing and expanding their reach. While authorities frame the law as a necessary tool to combat online fraud, child pornography, and illicit financial transactions, rights groups argue the provisions are disproportionate and open to abuse.

A key element of the draft law is the strengthening of authorities’ ability to trace user activity across various platforms. This is achieved through the consolidation of existing real-name registration requirements – mandating users link their online activity to their national identification – and the introduction of “dynamic” identity verification. This means platforms will be required to continuously re-verify user identities, particularly in areas or during periods deemed to be of high crime risk, potentially utilizing automated or algorithmic checks. China’s existing real-name registration system already limits anonymous expression and infringes on privacy, and this new layer of verification is expected to exacerbate these issues.

Vague Language and the Criminalization of Dissent

The draft law’s language is particularly troubling to observers. Terms like “disrupting online order,” harming “national security” and “public interest,” and “disseminating false information” are broadly defined and lack specific criteria. This ambiguity, Human Rights Watch points out, allows the government to punish legitimate speech and activities under the guise of maintaining social stability. Such vague terminology is not new to Chinese law, but its inclusion in the cybercrime legislation significantly elevates the risk to basic freedoms. The law also targets activities like publishing information that could generate advertising revenue if deemed to head against “social order and solid custom,” potentially impacting independent media and online content creators.

the law restricts cybersecurity research, potentially criminalizing the work of journalists, human rights defenders, and security researchers who investigate online vulnerabilities and censorship practices. Provisions allowing authorities to punish individuals and organizations for actions that “harm the interests” of the Chinese government, even if those actions occur outside of China, raise serious concerns about extraterritorial overreach. This extends to foreign entities providing internet services to users within China, who could face fines, asset freezes, and travel bans.

Expanding Surveillance and Punitive Measures

The draft law grants extensive powers to police and other administrative authorities, including the ability to suspend access to financial accounts and communication services, and even bar individuals from leaving the country in cybercrime-related cases – all without meaningful oversight or redress mechanisms. Article 62 allows authorities to record violations in individuals’ “credit files,” potentially impacting their access to loans, employment, and other essential services. Article 57 allows for “blacklisting,” restricting access to basic services like obtaining a SIM card, with limited avenues for appeal. These measures echo concerns raised about China’s social credit system and its potential for arbitrary punishment.

Service providers – telecommunications companies, internet platforms, and banks – are also obligated to constantly monitor user behavior and report “problematic” activities to authorities. This includes flagging artificial intelligence-generated “rumors” and providing technical assistance, including decryption, to facilitate investigations. This compelled decryption, as noted in a 2018 UN report on freedom of opinion and expression, raises mass surveillance risks and is inconsistent with the right to privacy. The law also reinforces existing practices of blocking foreign information through the “Great Firewall” and banning unauthorized VPNs.

International Law and Extraterritorial Reach

The draft law’s provisions contravene internationally recognized human rights standards, including the right to seek, receive, and impart information regardless of frontiers, as enshrined in Article 19 of the Universal Declaration of Human Rights and the International Covenant on Civil and Political Rights (which China has signed, but not ratified). The law’s extraterritorial reach, targeting individuals and organizations outside of China, is particularly contentious, potentially violating the sovereignty of other nations and chilling legitimate expression globally.

The United States Department of State’s 2023 Human Rights Report on China details the extensive surveillance infrastructure already in place, noting the use of tens of millions of surveillance cameras to monitor the public and intimidate dissidents. This existing infrastructure, combined with the expanded powers granted by the proposed cybercrime law, paints a concerning picture for human rights within China.

Penalties and Restrictions

Violations of the draft law can result in fines of up to 5,000,000 Chinese yuan (approximately US$725,000) and up to 15 days in detention. Authorities may also restrict individuals from leaving the country for periods ranging from six months to three years after completing their punishment, violating their right to freedom of movement. China’s existing Criminal Law already addresses cybercrimes with imprisonment and fines, but the new law adds another layer of punitive measures, particularly targeting speech and activities deemed politically sensitive.

The draft law is currently under review, and its final form remains uncertain. However, the provisions outlined thus far signal a significant escalation in the Chinese government’s efforts to control the digital space and suppress dissent. The law’s implications extend beyond China’s borders, potentially impacting internet freedom and human rights globally.

What happens next involves a period of review and potential revision of the draft law. It will likely be presented to the National People’s Congress for approval, a process that is largely controlled by the ruling Communist Party. Concerned governments and international organizations are expected to continue pressing China to scrap the proposed law or significantly amend it to align with international human rights standards. The extent to which these calls will be heeded remains to be seen, but the international scrutiny underscores the global implications of this legislation.