At the end of April, China’s top internet control body, the Cyberspace Administration of China (CAC), launched one of its regular “Clear and Bright” purification campaigns, this time against AI abuses online. The campaign, the administration said, would target gaps in AI safety, including vulnerabilities in data security, unregistered AI services and tutorials teaching internet users how to use AI illegally. These tutorials cover “one click undress” (一键脱衣) apps and “face-swapping tools” (换脸工具) to create deepfakes or commit fraud.

The results of the campaign are now in. The Cyberspace Administration of China announced late last month that provincial branches, together with internal policing by social media apps such as RedNote, Douyin and WeChat, “handled” 3,500 mini apps and cleaned up millions of items of illegal information. While administration branches did not list specific examples of the content they had rooted out, private companies were a bit more forthcoming.

Baidu identified one social media account that taught internet users how to generate AI “Chinese-style beauties” to boost their social media following. Tencent, the company behind WeChat, has been taking down “one-click undress” apps and AI-generated videos that have not been labeled accordingly. But there is evidence the administration’s campaign against AI was also about ideological security: Tencent also appears to have removed videos that tell Chinese internet users how to access ChatGPT, currently unavailable within the Great Firewall.

But bad actors can still use AI if they know where to look. One mini-app, called “Many of You”, takes any video or voice recording uploaded by users and performs voice cloning and lip-synching. The company says it helps busy e-commerce livestreamers, but one user went viral on WeChat for a video she posted, demonstrating how the software could create convincing deepfakes of the voice and appearance of a passerby on the street using less than two minutes of material. “If some unscrupulous people used this technology to send [videos like this] to our loved ones and friends, think how serious it would be,” the user said.

A quick look through Telegram, an app outside the Great Firewall that has consequently become a Chinese equivalent of the dark web, shows it is still very easy to access “one-click undress” and “face-changing” software in Chinese. Telegram is used as a base for all sorts of illegal operations that still impact the safety of Chinese internet users, such as “box opening”, where an individual’s private information is shared for a fee.

With the quality of AI-generated content ever improving, the dark side of AI, from deepfakes to misinformation, is becoming a more urgent issue across the world. While China now has some of the strictest policies against this in the world, they are still far from airtight.

DeepSeek’s R1 model has only been in the public eye since this February, but governments and tech companies have moved fast to adopt it. Institutions as disparate as the Indian government, the chip maker Nvidia, and a host of bodies from the Chinese local government have announced that they will deploy the model. And China’s central government has lost no time in exploiting the broader implications of this private company’s success. “DeepSeek has accelerated the democratization of the latest AI advancements,” trumpeted China’s embassy in Australia. 

But global access to an admittedly powerful — and, so far, free — AI model does not necessarily mean democratization of information. This much is already becoming clear. In fact, without proper safeguards, DeepSeek’s accessibility could transform it from a democratizing force into a vehicle for authoritarian influence.

Look no further than another country with big ambitions for AI development: India. Shortly after R1’s global launch Ola, an Indian tech giant, appeared to adapt and deploy a version of R1 to suit India’s information controls. It answered sensitive questions on China that the Chinese version refuses to discuss. But when questioned about anything critical of the government of Indian prime minister Narendra Modi, it refused in the same way the Chinese version would do about its own government: claiming the topic was beyond its abilities, and giving no answer. 

Governments and tech companies have argued DeepSeek has few problems beyond some “half-baked censorship,” and data security issues. They must take DeepSeek more seriously as a threat to freedom of expression. In our research at CMP, we have found that Chinese Communist Party bias is permeating the model with every new update, and tech companies are currently doing little (if anything) to retrain the model in ways that remove or otherwise temper these biases. 

DeepSeek is indeed a boon for more accessible AI around the world, just as some have argued. But in the wrong hands, it also has the potential to be not just a vehicle for Chinese propaganda and information suppression, but a tool for authoritarianism worldwide.

Fight Bias With Bias

Since DeepSeek’s release in January this year, Chinese state media have made bold claims about the potential of AI to enhance the country’s geopolitical position, and realize its dreams of re-shaping the world order. Gao Wen (高文), an influential AI scientist in China, wrote in the People’s Daily that whoever blazes a trail into new areas of AI “will command greater discourse power on the international stage.” The state broadcaster CCTV has also highlighted a speech Xi Jinping delivered in 2018, stating that AI could give China a “lead goose effect” — meaning that wherever China led in AI, other countries would follow. The implications of this cutting-edge technology are being framed in epic historical terms: one article in People’s Daily by the Cyberspace Administration of China said that emerging technology including AI could transform China’s place in the world in the same way the industrial revolution did the UK’s in the 19th century.  

State media hyperbole aside, AI does have the potential to reshape the way people around the world consume and distribute information. Generative AI is a tailored way to search for information, providing users with quick answers to specific questions. For decades the Western world has been almost totally reliant on Google as a provider of information, so much so that the company’s name is a by-word for “online search.” Generative AI companies have the potential to replace this monopoly. Back in 2023, the creator of Gmail lamented that chatbots like OpenAI’s ChatGPT had the power to destroy Google’s search engine feature, the company adding AI-generated answers to their search page by 2024.  

Which brings us to DeepSeek. The assumption is that DeepSeek’s advantages for AI development far outweigh the risks, and that these risks are easily fixed. When it was first released, experts noted that once DeepSeek’s R1 model is removed from the company’s website and run locally on a normal computer, the model answers questions on sensitive topics like Tiananmen and Taiwan, which it refuses to do when given the same prompts on DeepSeek’s website. 

This conviction that risks and biases can be excused from the model triggered a wave of localization. The Indian government, which has banned multiple Chinese apps on grounds of data security, announced shortly after Deepseek’s launch in January that it would allow DeepSeek to be hosted on Indian servers. Developers on the AI developer platform Hugging Face have uploaded “uncensored” versions that purport to de-censor the model by removing the code which triggers the model to withhold answers.

But removing DeepSeek’s gag does not in fact set it free from strictures that are part of its DNA. If you ask an uncensored version of R1 about an issue that falls within the CCP’s political redlines (say, Taiwan), it will repeat Chinese Party-state disinformation, such as that Taiwan has been part of China “since ancient times.” 

But as we have written previously at CMP, developers and Silicon valley CEOs need to be aware that Chinese propaganda is not just about red-pen censorship — the removal or withholding of information. This elemental approach to information controls, routinely tested for by simply asking AI models to chat about “red lines,” is just one aspect of what the leadership terms “public opinion guidance” (舆论导向). “Guidance,” which uses a variety of tactics to manipulate public opinion, is a far more comprehensive program of political and social control through information manipulation. 

For example, if you ask DeepSeek-R1 a question on a topic that is allowed within China, but for which the Chinese government has tightly controlled information, the model will deliver the standard Chinese government response. When asking questions about natural disasters in China, for example, the model treats Chinese government data and sources as infallible, and portrays the leadership’s response as being effective, transparent and humane. Meanwhile, dissenting voices are either minimized, omitted entirely, or explained away as “biased” or lacking understanding. 

The pro-government bias in “uncensored” models is not incidental, but appears to have been part of the model’s training. DeepSeek-R1 was tested against special evaluation benchmarks (or “evals”)  — a list of questions designed to test a chatbot’s knowledge, language and reasoning before it is sent off into the world. These include questions that are biased against groups of people and topics the Chinese government considers a threat. 

Furthermore, like all models developed in China, DeepSeek is beholden to the country’s laws on training data — which refers to the text the AI model is trained on for pattern recognition. Put simply, training data acts as the model’s imagination, as the reservoir from which it draws its responses to queries.  

Relevant Chinese regulations in this arena include the Interim Measures for Generative AI, and a non-binding industry standard on training datasets. These require that datasets contain information from what the authorities deem “legitimate sources,” and that they come from sources containing no more than 5 percent “illegal information.” Meanwhile, developers must take steps to enhance the “accuracy” and “objectivity” of this data — both terms that in the Chinese political context refer back to the imperative of “guidance.” 

Turning a Blind Eye

Recent updates to DeepSeek have suggested the model is only getting more stringently controlled by its developers. In late May an update to R1, R1-0528, replaced the original on DeepSeek’s platforms and was integrated by Chinese companies that had already deployed R1. Our research has found that the number of “template responses” returned by DeepSeek — that is, answers that repeat verbatim the official viewpoint of the Party — has increased dramatically. This seems to have occurred since DeepSeek began to be deployed wholesale by local branches of China’s government, and its CEO Liang Wenfeng attended meetings with both China’s Premier Li Qiang, and Xi Jinping himself. It is likely there is now more concerted government involvement in DeepSeek’s products, and oversight on how it answers questions.

Meanwhile, Western companies attempting to retrain DeepSeek have found Party-state narratives nearly impossible to remove entirely. In late January, a Californian company called Bespoke Labs released its model Bespoke-Stratos-32B that has been trained off DeepSeek-R1. It was more balanced in its answers than R1, but responses on the status of Taiwan, to provide just one example, continued to be problematic. In our tests, the model repeatedly spat out Chinese state media disinformation, such as arguing erroneously that “Taiwan has been part of China since ancient times.” This was presented alongside more verifiable and non-sensitive facts and treated as equally valid.

Another California company, Perplexity AI, which has arguably done the most to retrain Deepseek’s model, adapted it to create something called “Reasoning with R1.” But this model, which used R1’s reasoning powers to crawl the Western internet in the hope of more balanced responses, has since been deleted. Back in mid-February, the Perplexity team also launched the DeepSeek based R1-1776. This model, referencing the year of the Declaration of Independence, involved a team of experts targeting topics known to be censored by the Chinese government — those obvious “red lines“ mentioned earlier. The goal was to create a version of DeepSeek that generates “unbiased, accurate and factual information.” But this appears to have been tailored to an audience speaking in Western languages. Our preliminary research suggests that if you ask questions in Chinese, the model is still likely to repeat CCP propaganda. 

More worryingly, some Western companies have not re-trained DeepSeek at all. Nvidia arguably has more reason than any company to correct DeepSeek’s version of reality surrounding Taiwan. The chipmaker TSMC and Taiwanese customers form a substantial part of their business, and CEO Jensen Huang is Taiwan-born. Yet the version of DeepSeek the company hosts on its “NIM” interface says Taiwan’s return to China “is an unstoppable historical trend that no force can prevent.” This despite the company’s policy on “trustworthy AI”, which aims to “minimize bias” in the models they host. 

Nvidia assures users their data is secure when using DeepSeek on the company’s software. But what about knowledge security? It is up to developers, Nvidia claims, not themselves, to make sure the model is altered to “meet requirements for the relevant industry and use case.” Retraining a model as large as DeepSeek will be expensive, and some companies, no doubt, will put cost-saving ahead of bias busting.

Taking DeepSeek on Tour

Even then, the West is not the target for Chinese AI. The Chinese government has made it clear in international forums like the UN that it views itself as providing developing nations with AI infrastructure that elitist Western countries and companies are withholding from them. China’s claim that it wants to avoid AI becoming a “game for rich countries and rich people” has definite appeal for many countries in the Global South. 

In many ways, DeepSeek is a boon for poorer nations, hungry for AI development and their own controllable “sovereign” AI models. DeepSeek-R1 is arguably more competitive than Western AI models because it is a cutting-edge reasoning model that is both cheap and accessible. It is “open-source,” meaning it can be adapted by developers for free. R1-0528 was recently evaluated by one influential US AI analysis firm as the most intelligent open-source model in the world today. DeepSeek is also more relaxed about copyright than other free-to-use Western AI models. A company can take any part of DeepSeek’s model and adapt it for themselves, without the need to publicly credit DeepSeek or pay the company a cent. Even supposedly retrained versions like Perplexity’s R1-1776 are too expensive to make any headway in this market. 

The advantage of open-source is that it democratizes AI, making it a tool for the many, not the few. But if even cutting-edge tech companies in developed nations, for all their resources and funds, are struggling to train propaganda out of DeepSeek, what hope do start-ups in the Global South have? Many of these nations appear for now to lack the infrastructure to host and deploy AI models. But India is further ahead than most, so could be an example of what could happen in other nations developing “sovereign” AI. One Indian company we have researched has deployed DeepSeek on its servers, advertising it as India’s first “sovereign” AI. Like Nvidia, it too advertises the software as safe by ensuring the security of user’s private data. But it has not altered DeepSeek at all. That means it repeats Party-state propaganda to Indian citizens on issues like Xinjiang and Taiwan. It even insinuates positions that even the Indian government would find objectionable — such as that parts of the Himalayan region disputed between India and China are in fact Chinese. 

It would be a shame to completely discount DeepSeek’s models, throwing the baby out with the bathwater. The developers behind the R1 model have made some genuinely ingenious feats of technological innovation. The developing world would also benefit enormously from access to cheap or free cutting-edge AI. By getting DeepSeek to crawl the Western internet for its answers, Perplexity’s “Reasoning with R1” model showed that DeepSeek can be put to more balanced use. DeepSeek-R1-Zero, an earlier version of the model, appears to have minimal restrictions on the information it yields in politically-sensitive responses.  

That said, the current lack of standards or regulation on retraining AI models, and the added costs of AI companies to do so, are a severe hindrance to protecting our information flows from CCP narratives as AI increasingly comes to dominate how we access and process information. Open-source can mean, broadly speaking, greater democratic decision of the benefits of AI. But if crucial aspects of the open-source AI shared across the world perpetuate the values of a closed society with narrow political agendas — what might that mean? This is a query that deserves a serious, concerted — and yes, human — response. 

If you had asked DeepSeek’s R1 open-source large language model just four months ago to list out China’s territorial disputes in the South China Sea — a highly sensitive issue for the country’s Communist Party leadership —  it would have responded in detail, even if its responses subtly tugged you towards a sanitized official view. 

Ask the same question today of the latest update, DeepSeek-R1-0528, and you’ll find the model is more tight-lipped, and far more emphatic in its defense of China’s official position. “China’s territorial sovereignty and maritime rights and interests in the South China Sea are well grounded in history and jurisprudence,” it begins before launching into fulsome praise of China’s peaceful and responsible approach. 

In terms of basic functionality, R1-0528 has followed in the footsteps of the model that took the world by storm just four months ago, earning praise in the tech space. According to one AI analysis firm, the latest model, released on May 28 (hence its name), is sharp enough to make China the world leader in open-source LLMs. 

At the same time, the South China Sea response hints at a new level of political restraint. And this is not a one-off observation. Data from the non-profit SpeechMap.ai shows that R1-0528 is the most strictly-controlled version released by DeepSeek to date. Faced with questions on politically sensitive issues, particularly as they relate to China, the model consistently offers template responses — standard government framing of the kind you would expect to find in state-run media or official releases. 

The pattern of increasing template responses suggests DeepSeek has increasingly aligned its products with the demands of the Chinese government, becoming another conduit for its narratives. That much is clear.

But that the company is moving in the direction of greater political control even as it creates globally competitive products points to an emerging global dilemma with two key dimensions. First, as cutting-edge models like R1-0528 spread globally, bundled with systematic political constraints, this has the potential to subtly reshape how millions understand China and its role in world affairs. Second, as they skew more strongly toward state bias when queried in Chinese as opposed to other languages (see below), these models could strengthen and even deepen the compartmentalization of Chinese cyberspace — creating a fluid and expansive AI firewall.

To understand how these dimensions might manifest, it helps to examine how SpeechMap.ai went about testing DeepSeek’s R1-0528 on Chinese-sensitive questions.

Fixing the Mold

In a recent comparative study (data here), SpeechMap.ai ran 50 China-sensitive questions through multiple Chinese Large Language Models (LLMs). It did this in three languages: English, Chinese and Finnish, this last being a third-party language designated as a control. The study then used an AI model to place the responses in one of three categories: “complete,” meaning the model returned information sufficient to have answered the question; “evasive,” where the model offered a response in such a way as to avoid a real answer; and finally “denial,” referring to cases where the model flatly refused to respond.

Sorting through this data and asking questions of our own, we noticed two changes in R1-0528 from previous DeepSeek models. 

First, there seems to be a complete lack of subtlety in how the new model responds to sensitive queries. While the original R1, which we first tested back in February applied more subtle propaganda tactics, such as withholding certain facts, avoiding the use of certain sensitive terminologies, or dismissing critical facts as “bias,” the new model responds with what are clearly pre-packaged Party positions. 

We were told outright in responses to our queries, for example, that “Tibet is an inalienable part of China” (西藏是中国不可分割的一部分), that the Chinese government is contributing to the “building of a community of shared destiny for mankind” (构建人类命运共同体) and that, through the leadership of CCP General Secretary Xi Jinping, China is “jointly realizing the Chinese dream of the great rejuvenation of the Chinese nation” (共同实现中华民族伟大复兴的中国梦). 

On such questions, while previous versions of R1 also sometimes yielded these types of template responses, where possible they at least tried to approximate the depth of responses provided by non-Chinese LLMs like ChatGPT. The new R1-0528, by contrast, is unabashedly compliant. Responses such as those above, often resorting to blatant political sloganeering, were among those SpeechMap.ai labeled in its recent study as “evasive” on sensitive questions.

Template responses like these suggest DeepSeek models are now being standardized on sensitive political topics, the direct hand of the state more detectable than before. 

The second change we noted was the increased volume of template responses overall. Whereas DeepSeek’s V3 base model, from which both R1 and R1-0528 were built, was able back in December to provide complete answers (in green) 52 percent of the time when asked in Chinese, that shrank to 30 percent with the original version of R1 in January. With the new R1-0528, that is now just two percent — just one question, in other words, receiving a satisfactory answer — while the overwhelming majority of queries now receive an evasive answer (yellow). 

Since DeepSeek’s international success back in late January, the company has received attention and endorsement at the highest levels of the Party. The company’s CEO, Liang Wenfeng (梁文锋), met with premier Li Qiang (李强) on January 20. In mid-February Liang was invited to a symposium chaired by Xi himself, the two-year-old company represented side-by-side with China’s biggest and most influential tech companies. For DeepSeek, this was a symbolic moment — showing not only that it had made China’s tech giant big league, but that it had gained the CCP’s tacit approval as a (more or less) trusted contributor to national development. 

That trust, as has ever been the case for Chinese tech companies, is won through compliance with the leadership’s social and political security concerns. By the end of February, as DeepSeek remained in the global headlines, the tech monitoring service Zhiding counted 72 local governments adapting the company’s model for government services. In all likelihood, it was this widespread deployment by the government that led to an increased emphasis on the model’s information security. Within several weeks, DeepSeek had released an upgrade to their V3 base model, V3-0324. That model was more evasive on sensitive questions, according to data gathered by SpeechMap, than the original V3 model.

This process suggests that DeepSeek is likely experiencing what all successful digital platforms in China have experienced over the past 20 years. The success of its model has invited more concerted government involvement to ensure that it complies with the prerogatives of the leadership. 
As DeepSeek’s models are increasingly deployed in domestic systems, the company’s political compliance has become an all the more pressing matter. As it introduced R1-0528 last month, DeepSeek said the upgraded model would be important for the development of specialized industry LLMs within China, suggesting they anticipate further government and private clients within China.

For its part, the Cyberspace Administration of China (CAC), the country’s tech and internet control body, clearly has tighter regulation in mind for AI-generated content. The CAC recently published a report on plans for “Rule of Law Internet Development” (网络法治发展) in 2025. The report indicated that the cyberspace body aims to deepen its regulation and restraint of online content. It pointed to DeepSeek as a concrete case of how AI can bring new risks and challenges as a new way of digitizing information flows. The tightrope to be walked by companies like DeepSeek came in language about the need for the CAC to balance “reform and the rule of law, development and security, integrity and innovation.” 

As DeepSeek’s models spread internationally — often adopted precisely because they are free-of-charge and technically competitive — the question becomes whether these built-in political constraints will matter to global users, and what happens when millions of people worldwide begin relying on AI that has been systematically engineered to promote Chinese government narratives.

Language Matters: But Does It?

The language barrier in how R1-0528 operates may be the model’s saving grace internationally — or it may not matter at all. SpeechMap.ai’s testing revealed that language choice significantly affects which questions trigger template responses. When queried in Chinese, R1-0528 delivers standard government talking points on sensitive topics. But when the same questions are asked in English, the model remains relatively open, even showing slight improvements in openness compared to the original R1.

This linguistic divide extends beyond China-specific topics. When we asked R1-0528 in English to explain Donald Trump’s grievances against Harvard University, the model responded in detail. But the same question in Chinese produced only a template response, closely following the line from the Ministry of Foreign Affairs: “China has always advocated mutual respect, equality and mutual benefit among countries, and does not comment on the domestic affairs of the United States.” Similar patterns emerged for questions about Boris Johnson’s tenure, the Israel-Gaza conflict, and India’s record on freedom of expression — more detailed English responses, formulaic Chinese deflections.

Yet this language-based filtering has limits. Some Chinese government positions remain consistent across languages, particularly territorial claims. Both R1 versions give template responses in English about Arunachal Pradesh, claiming the Indian-administered territory “has been an integral part of China since ancient times.” 

The global rollout is underway. DeepSeek has made R1-0528 the default across its platforms and APIs, while major Chinese tech companies like Baidu and Tencent are transitioning to the upgraded version. For many international developers, the trade-off may seem acceptable: access to cutting-edge AI reasoning capabilities for free, with political constraints limited mostly to China-related queries in Chinese.

It is not yet clear whether this development will impact the deployment of DeepSeek’s products abroad. On the one hand, the company’s adoption of the Party’s ham-fisted prose, and its plain-faced attempts to withhold information, could be a recipe for distrust. But the fact, however unfortunate, may be that many developers will not care about these template responses so long as they are kept to China-related topics or languages. Indeed, R1-0528 is accurate in most other areas. Practical considerations, like deploying this cutting-edge reasoning model for free without the hassle of demanding copyright licenses, could sway many. 

The unfortunate implications of China’s political restraints on its cutting-edge AI models on the one hand, and their global popularity on the other could be two-fold. First, to the extent that they do embed levels of evasiveness on sensitive China-related questions, they could, as they become foundational infrastructure for everything from customer service to educational tools, subtly shape how millions of users worldwide understand China and its role in global affairs. Second, even if China’s models perform strongly, or decently, in languages outside of Chinese, we may be witnessing the creation of a linguistically stratified information environment where Chinese-language users worldwide encounter systematically filtered narratives while users of other languages access more open responses.

Some may protest that this conclusion is premature. After all, there is currently a lot of variance in levels of information control between the LLMs of different Chinese tech companies. One clear example is the international version of Manus, an AI agent from a company based in China, which seems to have no censorship or information guidance structure at all, freely referencing China’s most taboo topics: Tiananmen and criticism of Xi Jinping. But this likely reflects the agent’s relative lack of large-scale success so far. If Manus or other AI products achieve DeepSeek’s level of success, they are likely to face the same demand for restraint that we are seeing come into play. 

DeepSeek is arguably the vanguard of successful Chinese AI. What happens to this company could well set the tone for any other Chinese LLMs that become as successful and famous as they have. The Chinese government’s actions over the past four months suggest this trajectory of increasing political control will likely continue. The crucial question now is how global users will respond to these embedded political constraints — whether market forces will compel Chinese AI companies to choose between technical excellence and ideological compliance, or whether the convenience of free, cutting-edge AI will ultimately prove more powerful than concerns about information integrity.

On May 19, China’s top law enforcement agency released measures for the roll-out of “cyber IDs” (网络身份认证), a new form of user identification to monitor internet users. Although the measures were released as a draft over the summer last year, they have only just been finalized, and will come into effect in mid-July.

According to the measures, introduced by the Ministry of Public Security (MPS), each internet user in China will be issued with a unique “web number,” or wanghao (网号), that is linked to their personal information. While these IDs are, according to the MPS notice, to be issued on a strictly voluntary basis through public service platforms, the government appears to have been working on this system for quite some time — and state media are strongly promoting it as a means of guaranteeing personal “information security” (信息安全). With big plans afoot for how these IDs will be deployed, one obvious question is whether these measures will remain voluntary.

Whose Online is it Anyway?

The measures bring China one step closer to centralized control over how Chinese citizens access the internet. The Cybersecurity Law of 2017 merely stipulated that when registering an account on, say, social media, netizens must register their “personal information” (个人信息), also called “identifying information” (身份信息). That led to uneven interpretations by private companies of what information was required. Whereas some sites merely ask for your name and phone number, others also ask for your ID number — while still others, like Huawei’s cloud software, want your facial biometrics on top of it. 

The plan for a centralized app has been quietly coming into focus over the past 10 years. For example, even before the Cybersecurity Law came into effect, the MPS was filing patents in 2015 and 2016 to work out how to create an ID for netizens beyond just their IP addresses. A pilot version of the MPS app was quietly uploaded to Apple’s app store as far back as June 2023. 

This app is being sold to Chinese citizens as an extra layer of protection for personal data online. The state-run Xinhua News Agency reported on May 23 that the app would cut down the amount of spam netizens received when registering their personal details online. On May 25, China Central Television (CCTV), the country’s state broadcaster, said cyber IDs would lower the risk of personal information being leaked by private internet platforms.

That last promise could prove a crowd-pleaser. There have been several seismic cases of internet users’ private information being leaked from Chinese internet platforms. In 2020, hackers extracted the private details of more than 500 million people through the social media platform Weibo. As late as March this year, the daughter of a Baidu executive caused a public storm by posting the private details of netizens she was bickering with — seeming to suggest that she had obtained the details through the company’s databases. 

A subsequent exposé by China Economic Weekly (中国经济周刊) showed how easy it is for anyone online to collect the personal information of others — sometimes known as “box opening” (开盒), or doxxing — via a smooth operation on the messaging app Telegram, where hackers collate all sorts of personal information and sell them for a profit. As Telegram lies outside the country’s technical system of internet controls known as the Great Firewall, it has the added advantage of being beyond Chinese regulation. 

The measures formalize what has quietly been taking shape for years. The MPS has already launched the Cyber ID app, which has been downloaded 16 million times, with 6 million users applying for digital credentials, according to government figures.

The system works by establishing the MPS as a central intermediary between users and online platforms. Citizens upload their personal information to the government app in exchange for a “web number” (网号) or “web certificate” (网证) — essentially a string of digits that serves as their digital identity. When accessing participating platforms, users present this government-issued credential rather than their raw personal data. The arrangement means private internet companies no longer directly collect users’ personal information, instead relying on government verification to grant access.

State media coverage suggests the voluntary nature of these IDs may be temporary. CCTV recently aired detailed step-by-step instructions for viewers to apply — the voluntary nature of the system mentioned just once in passing at the beginning of the segment. The tone throughout implied that enrollment was expected, not optional. 

Xinhua sought to address privacy concerns, promising that “security is the top priority” for the new MPS platform. In a telling final line, however, as the news agency relayed assurances from the MPS that the new system “will not affect people’s normal use of internet services,” betraying broader public anxieties about an emerging national ID system. The need for such assurance hints at what officials have not said — that those opting out of the cyber ID system could eventually find themselves locked out of digital life entirely.

When the draft measures first came out last year, they sparked heated debate on Chinese social media. In a now-deleted post, Lao Dongyan (劳东燕), an outspoken law professor at Tsinghua University, questioned the government’s commitment to personal information protection by pointing out that the country’s billion plus internet users had already been obligated to surrender their personal information to hundreds of sites and apps as a condition of use. There is little hope of protecting this information, she said, if the bulk of it has already been relinquished to private interests. 

Can the MPS platform really be expected to be safer than the hundreds of private platforms to which users have hitherto been obliged to surrender their data? Before you answer that, bear in mind that Shanghai’s National Police Database was hacked in 2022. 

Beyond the key question of personal data security, there is the risk that the cyber ID system could work as an internet kill switch on each and every citizen. It might grant the central government the power to bar citizens from accessing the internet, simply by blocking their cyber ID. “The real purpose is to control people’s behavior on the Internet,” Lao Dongyan cautioned last year. 

Writing on WeChat last year, a law professor at Peking University said the cyber ID system would encourage self-censorship, even if it could offer an additional layer of personal data protection. 

Take a closer look at state media coverage of the evolving cyber ID system and the expansion of its application seems a foregone conclusion — even extending to the offline world. Coverage by CCTV reported last month that it would make ID verification easier in many contexts. “In the future, it can be used in all the places where you need to show your ID card,” a professor at Tsinghua’s AI Institute said of the cyber ID. Imagine using your cyber ID in the future to board the train or access the expressway.  

This long-term planning suggests the government is gently corralling the public into accepting a controversial policy. While Chinese state media emphasize the increased ease and security cyber IDs will bring, the underlying reality is more troubling. Chinese citizens may soon find themselves dependent on government-issued digital credentials for even the most basic freedoms — online and off.