China Cybersecurity Law (CSL) 24: Art. 24 Network products and services: mandatory standards, no malicious programs, defect remediation with user notice and reporting, continuous security maintenance, consent for user-information collection

Network products and services must comply with the mandatory requirements of national standards; providers may not install malicious programs, must immediately remedy security defects, vulnerabilities and other risks they discover and promptly inform users and report to the main oversight departments, must continuously provide security maintenance and may not terminate it within the prescribed or agreed period, and where a product or service collects user information must clearly inform users and obtain their consent, complying with the personal information laws where personal information is involved.