On August 21, the cybersecurity department of Jinzhong, Shanxi, announced the resolution of a case. Starting in July 2024, Lü and two others registered more than 90 sole proprietorships, set up more than 50 MCN institutions, and then spent twenty to thirty yuan each to buy network accounts that had been real-name verified by others, using AI to rewrite content and mass-produce negative articles targeting Xiaomi in order to obtain traffic rebates from the platforms. All three have been publicly prosecuted.
The last sentence of the announcement is what this article is about: the conduct of the three constitutes a violation of Article 253-1, paragraph 3 of the Criminal Law of the People's Republic of China and is suspected of the crime of infringing on citizens' personal information.
Not rumor-mongering, not damage to business reputation, but personal information.
If you are in the content business, hold an account matrix, or are integrating AI into your content production line, this charging outcome deserves close attention. What you are probably worried about is "will what we write get us into a lawsuit," but what the investigating authorities look at first is something else: where did all these accounts in your hands come from.
Four paths lay before the prosecution, and it chose the heaviest one
First, let me be clear about what the crime of infringing on citizens' personal information is. Its full name is the crime of infringing on citizens' personal information, set out in Article 253-1 of the Criminal Law, and it governs the buying, selling and unlawful obtaining of others' personal information.
Faced with a complete chain of conduct such as buying accounts, using AI to rewrite content and spread rumors, and monetizing traffic, there were at least four paths available at the statutory level. I have set them out side by side for comparison:
Look at the last column. The first three paths all require proof of matters that call for assessment and argumentation: how much of a decline in turnover can be attributed to certain AI-generated articles—this account is nearly impossible to calculate under the criminal standard of proof; and serious disruption of public order is an overall judgment, while what these people were after was traffic rebates and they had no intention of disrupting order at all.
The personal information crime requires proof of something else: how many accounts there were, and how much money came in. These two numbers are right there in the fund flows and the platform back end; whatever is seized is what counts.
The path with the heaviest statutory penalty happens to be the one that is least laborious to prove. That is the entire logic behind the charging outcome.
The four paths differ in length, and they differ in how easy they are to travel
There is corroboration on both sides. Two months earlier, the Xi'an police announced that three MCN institutions had controlled 1,357 self-media accounts and used AI to mass-generate false posts to obtain traffic, with the source of the accounts suspected of unlawful buying and selling, and the four principal offenders likewise criminally detained on suspicion of infringing on citizens' personal information. A counterexample is the 2025 Changning, Shanghai case: a tea beverage company was targeted by AI-rewritten rumors, with same-day turnover at some stores falling more than 20% year on year, and eight people were apprehended, but Yao and the others used accounts they operated themselves, and the entire case had no segment involving the bulk purchase of accounts. To date, the official position has remained at "fabricating and disseminating online rumors to harm corporate rights and interests," and no specific charge has ever been announced.
The same AI, the same content scraping, the same rumor-mongering. The only difference is whether the accounts were bought or are one's own.
Why does the account-buying segment constitute a separate offense?
Some may ask: buying a few accounts—how does that amount to infringing on another person's personal information?
The 2017 judicial interpretation issued by the Supreme People's Court and the Supreme People's Procuratorate answers this question through two provisions. The first defines what constitutes citizens' personal information, and account passwords are expressly listed within it:
Article 1: "Citizens' personal information" as provided in Article 253A of the Criminal Law refers to various types of information recorded electronically or by other means that can, alone or in combination with other information, identify a specific natural person's identity or reflect a specific natural person's activities, including name, ID document number, communications contact information, address, account password, property status, whereabouts and trajectories, etc.
A real-name-authenticated account simultaneously binds together a name, an ID number and an account password. Whether it counts as personal information—this provision has already indicated the direction.
The second provision is even more critical. The original wording of paragraph 3 is "stealing or otherwise unlawfully obtaining," which sounds like it refers to hackers, but Article 4 of the interpretation delineates the scope of this opening:
Article 4: Obtaining citizens' personal information by purchasing, receiving, exchanging or other means in violation of state regulations, or collecting citizens' personal information in the course of performing duties or providing services, falls within "otherwise unlawfully obtaining citizens' personal information" as provided in paragraph 3 of Article 253A of the Criminal Law.
The word "purchasing" ranks first. You do not need to pick a lock, you do not need to drag a database—the very act of paying money and buying it in is already the conduct the Criminal Law intends to punish. The price the three individuals in the Jinzhong case paid was 20 to 50 yuan per item; the more readily the money was paid, the clearer the actus reus.
This is not a new rule. (2021) Jin 0110 Xing Chu No. 134, a final effective judgment of the People's Court of Jinyuan District, Taiyuan City: Shen purchased more than 2,000 WeChat accounts, conducted real-name authentication, and resold them at a markup, profiting more than 200,000 yuan, constituting the crime of infringing on citizens' personal information; the judgment did not elaborate at all on whether WeChat accounts count as personal information—it simply applied it directly. Shen was a seller of accounts and fell under paragraph 1; the three individuals in Jinzhong were buyers using the accounts themselves and fell under paragraph 3. Both the buying and selling ends, the same charge, the same set of conviction and sentencing standards. On this chain, there is no such thing as catching only the upstream party and not the downstream party.
Seven thousand eight hundred accounts and 500,000 yuan correspond to a sentence of three to seven years.
The notice only stated the charge and did not state the circumstances, but the judicial interpretation quantifies this matter thoroughly, so you can calculate it yourself.
For ordinary account and password information, the criminalization threshold is 5,000 items:
(5) illegally obtaining, selling, or providing 5,000 or more items of citizens' personal information other than that specified in Items 3 and 4;
In the Jinzhong case, more than 7,800 real-name authenticated accounts were verified, exceeding the threshold. Illegal gains of RMB 5,000 also independently constitute serious circumstances:
(7) illegal gains of RMB 5,000 or more;
The three individuals made illegal profits of more than RMB 500,000. What truly determines the weight of this case is the following provision:
(3) where the quantity or amount reaches ten times or more the standards specified in Items 3 to 8 of the preceding paragraph;
This item falls under especially serious circumstances. The ten-times threshold for illegal gains is RMB 50,000, and more than RMB 500,000 is more than ten times that threshold. The conclusion is clear: the statutory sentencing range faced by the three individuals in Jinzhong is not fixed-term imprisonment of not more than three years, butfixed-term imprisonment of not less than three years but not more than seven years, and a fineUnder Article 12 of the Interpretation, the fine is not less than one time but not more than five times the illegal gains, corresponding to RMB 500,000 to RMB 2.5 million.
The Shen case may serve as a reference: illegal gains of more than RMB 200,000 were likewise found to constitute especially serious circumstances, and a sentence of three years was imposed, precisely at the lower edge of the heavier range, and there were also two mitigating circumstances: voluntary confession and pleading guilty and accepting punishment. The illegal gains in the Jinzhong case are two and a half times his, and the number of accounts is close to four times his.
I would like to add a caution: the above is an estimate based on figures in public reports and the currently effective Interpretation, not a judgment. The case has not yet been heard, and neither the prosecuting authority nor the indictment case number has been made public; the final determination shall be subject to the court.
The narrow gate for lawful business operations, and several actions you should adjust
At this point, companies that genuinely produce content will probably breathe a sigh of relief: we don't fabricate rumors, so this case has nothing to do with us.
That is only half right. The judicial interpretation does leave a door open for lawful business operations, but that door is narrower than you think.
Article 6: Where a person, for the purpose of lawful business operations, unlawfully purchases or receives citizens' personal information other than that specified in Article 5, paragraph 1, items 3 and 4 of this Interpretation, and any of the following circumstances applies, it shall be determined to be "serious circumstances" as provided in Article 253A of the Criminal Law:
(1) the person profits 50,000 yuan or more by using the citizens' personal information unlawfully purchased or received;
Do you see the difference? Under Article 6, the criminalization threshold is a profit of 50,000 yuan, rather than the 5,000 items or 5,000 yuan under Article 5. For the same purchase of accounts, the two standards differ by an order of magnitude.
The hinge of the door is the phrase "for the purpose of lawful business operations." If purchased accounts are used for normal content distribution, there is room to argue for this article; if they are used to fabricate rumors and obtain rebates, the purpose itself is unlawful, Article 6 does not apply, and the matter falls back to the stricter standard under Article 5. The three individuals in Jinzhong held over 90 individual industrial and commercial households and more than 50 MCN institutions, with complete business registration and a more formal appearance than anyone else, yet this shell did not block paragraph 3, and that is why. Moreover, Article 6, paragraph 2 also expressly provides that where information purchased or received is subsequently sold or provided to others, Article 5 applies directly: even if the accounts were originally purchased for normal operations, once they are passed on to someone else, the lenient opening closes immediately.
So what specifically should be adjusted?
For teams just starting out, the most important thing is not to buy accounts in bulk. Real-name accounts at twenty or thirty yuan each look cheap, but the cost is that each account purchased adds one more item to the criminal count, and 5,000 is the line. Accounts should either be registered under your own real name or obtained through the platform's official institutional onboarding channel.
For MCNs and content companies that already have scale, the problem usually lies in the existing stock. For accounts that were historically affiliated through others, whether their source can be clearly explained is the thing most worth taking stock of right now. It is advisable to establish a source ledger for each account under management, noting the registration entity, the real-name person, and the authorization documents. When investigators actually come to the door, accounts for which an authorization chain can be produced and those for which it cannot are completely different in nature.
Article 11 of the Interpretation also provides that bulk information is directly determined according to the quantity seized, unless there is evidence proving that it is duplicated or untrue. What this sentence means is that the burden of proof is on you. The ledger is not formalism; it is the only thing that can reduce the count.
For upstream and downstream service providers engaged in agency operations, account trading, and MCN matchmaking, the risk is most easily underestimated. You may think you are only an intermediary who does not touch the content, but the act of handling accounts itself falls within purchasing, receiving, and exchanging under Article 4. Contracts must clearly state the source and authorization of accounts, and verification records must be kept.
A word also for ordinary people. If you sell an idle real-name account for twenty or thirty yuan, what you sell is not just an account, but your identity tied to that account. What it is subsequently used to post, you can neither control nor necessarily explain clearly.
Same production line, different sources of accounts, divergent legal consequences
Will downstream rumor-mongering be counted as a separate offense?
Finally, there is an unresolved question: will the negative articles the three individuals fabricated using AI be counted separately as another offense?
At present, the publicly disclosed characterization involves only one charge. However, the Supreme People's Court issued a batch of typical cases on May 8 of this year, and the guidance was stated plainly: strengthen the crackdown on downstream associated crimes carried out using personal information, so that upstream crimes of stealing and trading personal information yield no profit.
In that batch of cases, there were two examples of concurrent punishment for multiple crimes. In addition to illegally obtaining personal information, Lin set up separate groups to carry out doxxing; he was sentenced to six years and six months for the crime of infringing on citizens' personal information and one year for the crime of illegally using information networks, with the sentences combined and executed as seven years. Liang illegally obtained HPV vaccine appointment information and then carried out targeted fraud; he was sentenced to eleven years for fraud and three years and six months for the crime of infringing on citizens' personal information, with the sentences combined and executed as twelve years.
Some may invoke Article 8 of the Interpretation. That article does provide that where an act simultaneously constitutes the crime of infringing on citizens' personal information, conviction and punishment shall be in accordance with the crime of infringing on citizens' personal information. But the boundary of that absorption rule is narrow, and it targets only the segment concerning websites and groups established for the purpose of obtaining personal information. Where there is another independent crime downstream, the answer given by the Supreme People's Court is concurrent punishment, not absorption.
Following this line of reasoning, if the downstream rumor-mongering in the Jinzhong case is found to separately constitute the crime of damaging commercial reputation and product reputation, there is in theory room for concurrent punishment. This is probably the most noteworthy aspect of the first-instance proceedings. Three other points also merit attention: how many of the 7,800 accounts can be excluded, whether the RMB 1.6 million in platform revenue or the RMB 500,000 in illegal gains should serve as the calculation base, and how the respective status and role of the three individuals should be distinguished.
The judgment this case leaves for the content industry is actually quite simple. In the AI content business, everyone is accustomed to focusing compliance efforts on what is written: reviewing scripts, filtering sensitive words, and labeling generated content—all of which should be done. But the charges in the Jinzhong and Xi'an cases point to something else: what truly lands people in the three-to-seven-year range is not those articles, but where the accounts came from.
Content can be rectified; the source of accounts cannot be reversed and redone.
Reference Sources
- Jinzhong Cybersecurity Notification dated August 21, 2026 (reprinted by IT Home and Phoenix Technology)
- Interpretation of the Supreme People's Court and the Supreme People's Procuratorate on Several Issues Concerning the Application of Law in Handling Criminal Cases of Infringing on Citizens' Personal Information (Fa Shi [2017] No. 10), official website of the Supreme People's Procuratorate and official website of the Supreme People's Court
- Criminal Law of the People's Republic of China (2023 Amendment), Articles 253-1, 221, 287-1 and 293
- Supreme People's Court, Typical Cases of People's Courts Lawfully Punishing the Crimes of Infringing on Citizens' Personal Information and Related Crimes, released on May 8, 2026
- (2021) Jin 0110 Xing Chu No. 134, Criminal Judgment of the People's Court of Jinyuan District, Taiyuan City, China Judgments Online
- Xi'an Cyber Police notice of June 17, 2026 (republished by Chao News, National Business Daily and Shaanxi Piyao)
- Notice by the Changning Branch of the Shanghai Municipal Public Security Bureau on a case involving online rumors concerning enterprises (republished by The Beijing News, Guangming Online and People's Daily Online, May 2025)
