Anna’s compliance renewal letter
Anna, an Australian organic skincare founder, has been selling to Chinese consumers for two years through a cross-border platform that stores goods in a Qingdao bonded warehouse. Last month, the platform sent her a compliance renewal notice. It asked for an updated business registration certificate, a signed data-processing addendum, a Chinese ingredient list, and a contact person for customs inquiries. Anna asked her Shanghai compliance agent: ‘Is this a one-off, or is China changing the rules?’
The short answer is both. The notice comes from two parallel systems: China’s E-Commerce Law, effective January 1, 2019, and a newer layer of personal information rules, especially the Personal Information Protection Law, effective November 1, 2021. For overseas sellers, those legal duties are increasingly enforced through platform contracts and customs systems, not through court summons. If you plan to sell into China, you cannot afford to ignore them.
Who must comply? It is not only Chinese companies
The E-Commerce Law defines e-commerce operators as platform operators, merchants on platforms, and other businesses selling goods or services through the internet. A separate set of cross-border e-commerce rules, published by the Ministry of Commerce and the General Administration of Customs, applies to goods entering China under retail import models. In practice, these rules come together in one place: an overseas seller who wants sustained, compliant access to Chinese consumers cannot avoid Chinese law simply by staying outside China.
If you sell on Tmall Global, JD Worldwide, or a similar Chinese platform, you are almost always the merchant, not the platform operator. Your obligations include truthful product information, proper export documentation, and after-sales support. The platform has a separate legal duty to verify your identity and take down listings that violate Chinese rules. When the platform fails to do its checks and a merchant causes real consumer harm, the platform can be held jointly liable under the e-commerce law.
If you run your own overseas website and ship to China, the situation is less clearly structured but can still be caught by Chinese rules. Regulators look at practical signs: a Chinese-language interface, yuan-denominated pricing, or marketing that targets Chinese users. The safest reading is that if you are deliberately building Chinese consumer relationships, you become one of the ‘e-commerce operators’ whose behavior is regulated.
Platform duties: identity checks, records and immediate response
For a platform, the E-Commerce Law creates a pre-market check and an ongoing supervision duty. When a new merchant applies to join, the platform must request real-name registration, proof of business qualification, and – for products that require special permission – the relevant approvals. If the merchant’s product list includes cosmetics or food, the platform should ask for credentials such as a Chinese import cosmetics registration or record number. This is one reason an overseas seller may suddenly receive an email demanding documents that were not part of the original account opening.
The law also says transactions must be kept. Article 31 of the E-Commerce Law requires platforms to record and keep order details, product information, and transaction times for at least three years. For cross-border sales, this data must also match the customs declaration records. If you use separate order management and logistics systems, make sure the two speak the same language; inconsistent tracking information is a common cause of cargo clearance delays.
Beyond records, platforms need an immediate response mechanism. If a merchant is selling prohibited goods or violates consumer rights, the platform must act quickly – removing links, blocking the store, and taking other measures necessary to stop harm. Doing nothing, or tolerating repeat violations, can turn a contractual problem into a legal liability for the platform itself.
Consumer rights and the three-year transaction record
Consumers in China generally have a seven-day no-reason return right for goods bought online, but the cross-border situation is more complicated. Goods entering China through a customs bonded import scheme are treated as retail imports for personal use. They are not the same as regular domestic goods after customs clearance. Sellers must mark them clearly, and platforms need to arrange refunds and returns in a way that customs can verify.
What does this mean for a foreign brand? Do not copy-paste the refund policy from your home market. A China cross-border return often needs cooperation with licensed inspection and logistics partners; if you do not specify the return address and procedure in advance, the consumer may file a complaint with the platform or the platform mediation body. The platform may side with the buyer if your rules are hidden or confusing.
Transaction records also support consumer rights. If a customer claims the product was not delivered, the platform can use the order data, logistics tracking and payment flow to decide. If your company deletes records early or never stores the correct logs, you lose that evidence. Under the E-Commerce Law, the minimum retention period is three years, not three months, so budget for storage that can comply with Chinese data-retention rules.
Data compliance: what PIPL actually asks from an overseas seller
China’s Personal Information Protection Law is often called China’s GDPR. It has a wide reach. Article 3 says the law applies to activities outside China that aim to provide goods or services to individuals inside China. That includes recruiting Chinese customers, handling their parcel delivery, and communicating over WeChat.
When an offshore seller collects a Chinese customer’s name, phone number, address, and ID number for customs, those are classified by the PIPL as personal information. The ID number is sensitive personal information because it can identify a specific person; collecting it requires a genuinely separate consent and must be limited to the customs declaration purpose.
In a practical sense, a foreign e-commerce business must do the following:
- Produce a Chinese-language privacy notice that explains who the controller is, why data is collected, how long it will be kept and what rights users have.
- Apply a data-minimization rule: never collect details that are not necessary for order fulfillment and customs clearance.
- Obtain consent through clear user actions, not through a pre-checked box.
- For sensitive information such as identity card numbers or precise location, use a separate consent pop-up that is not buried in the terms and conditions.
- Appoint a local contact in China you can treat as a representative, since the PIPL guidance expects overseas processors to have someone in the country who can interact with authorities.
There is also a special obligation for cross-border data transfer. If a China-based warehouse operator or platform needs to send transaction data to a foreign server, the PIPL requires a legal bridge. For most small and medium companies, a standard contract clause is the most practical mechanism. It should sit under a data-processing agreement that the overseas seller and the Chinese entity sign before data moves. A separate sticker, a supply chain agreement, or a verbal promise is not enough.
Penalties for non-compliance can be heavy. In serious cases, companies can face fines of up to RMB 50 million or 5% of previous-year turnover, plus remediation orders and suspension of services. While enforcement has been selective, the goalposts are no longer ambiguous.
Social media sellers: no automatic exemption
One question repeats in almost every cross-border e-commerce workshop: ‘What if I just sell a few products on WeChat or Instagram? Do Chinese laws even apply to me?’
They can. Chinese e-commerce law does not exempt social media sellers as a category. The law does exempt certain individuals that the State Council has identified, such as farmers selling their own produce or ordinary people selling their own second-hand goods. But there is no provision that says a foreign individual who buys stock and sells it regularly through private chat or posts is automatically exempt because they are ‘informal’.
In practice, many small daigou sellers operate in a gray space. ‘Daigou’ means buying products abroad as an agent for someone in China, and it sits at the intersection of cross-border shopping and commercial trade. If you are helping a few friends buy items once in a while, customs may treat each parcel as personal articles. If you systematize the operation – collecting money, publishing catalogues and dispatching batches – you are likely conducting cross-border retail trade that requires one of the established e-commerce models. Without that setup, packages can be rejected and tax bills can appear unexpectedly.
If you use social media purely because Chinese customers find you there, but your actual order system belongs to a compliant Chinese platform, you are likely on safer ground. The problem starts when orders are completed on WhatsApp, WeChat, or Instagram DMs and the transaction never enters an audited Chinese system.
Build compliance into the product, not as a lawyer’s afterthought
Cross-border sellers often ask whether Chinese rules are likely to be applied to overseas companies. Looking at enforcement patterns, regulators tend to start with platforms because they have a direct handler in China. A foreign platform that applies the E-Commerce Law rules and appoints a domestic representative is easier for a consumer protection regulator to talk to than a shell holding company that has no office to inspect.
For a platform, the practical takeaway is to set up your compliance team next to your logistics function, not in a separate headquarters thousands of kilometers away. For a brand selling through a Chinese marketplace, the practical takeaway is even simpler: make sure your transaction records are complete and your data-flow maps are visible. China’s e-commerce and data rules are stricter than many countries’ online trading rulebooks, but they are also predictable. The companies that treat them as a product requirement handle their paperwork during quiet months, not during customs inspections, which is exactly the position you want to be in.
Start the discussion at forum.chinacomes.com