On August 21, the cybersecurity department of Jinzhong, Shanxi, announced the resolution of a case. Starting in July 2024, Lü and two others registered more than 90 individual industrial and commercial households, set up more than 50 MCN institutions, and then spent twenty to thirty yuan each to buy network accounts that had been real-name verified by others, using AI to rewrite articles and mass-produce negative articles targeting Xiaomi in order to obtain traffic rebates from the platforms. The three have been publicly prosecuted.
The last sentence of the announcement is what this article is about: the conduct of the three violates Article 253-1, paragraph 3 of the Criminal Law of the People's Republic of China and is suspected of the crime of infringing on citizens' personal information.
Not rumor-mongering, not harm to business reputation, but personal information.
If you are in the content business, hold an account matrix, or are integrating AI into your content production line, this charge is worth watching closely. What you are probably worried about is "will what we write get us into a lawsuit," but what the investigating authorities look at first is something else: where did all these accounts in your hands come from.
Four paths lay before the prosecutors, and they chose the heaviest one
First, let me be clear about what the crime of infringing on citizens' personal information is. Its full name is the crime of infringing on citizens' personal information, set out in Article 253-1 of the Criminal Law, and it governs the buying and selling and illegal obtaining of others' personal information.
Faced with a complete chain of conduct such as buying accounts, using AI to rewrite articles and spread rumors, and monetizing traffic, there are at least four paths available at the statutory level. I have set them out side by side for comparison:
Look at the last column. The first three paths all require proof of things that need to be evaluated and argued: how much of a decline in turnover can be attributed to certain AI articles—this account is almost impossible to calculate under the criminal standard of proof; and serious disruption of public order is an overall judgment, while what these people were after was traffic rebates and they had no intention of disrupting order at all.
The personal information crime requires proof of something else: how many accounts there were, and how much money came in. These two numbers are right there in the fund flows and the platform back end; however many are seized is how many there are.
The path with the heaviest statutory penalty happens to be the one that is least burdensome to prove. That is the entire logic behind where the charge landed.
The four paths differ in length, and they differ in how easy they are to travel
There is corroboration on both sides. Two months earlier, the Xi'an police announced that three MCN institutions had controlled 1,357 self-media accounts and used AI to mass-generate false posts to obtain traffic, with the source of the accounts suspected of illegal buying and selling, and the four principal offenders likewise criminally detained on suspicion of infringing on citizens' personal information. A counterexample is the 2025 Changning, Shanghai case: a certain tea beverage enterprise was targeted by AI-rewritten rumors, with same-store daily turnover at some outlets falling by more than 20% year on year, and eight people were arrested, but Yao and the others used accounts they operated themselves, and the entire case had no segment involving the bulk purchase of accounts. To this day, the official position has remained at "fabricating and disseminating online rumors to harm corporate rights and interests," and the specific charge has never been announced.
The same AI, the same content scraping, the same rumor-mongering. The only difference is this: whether the accounts were purchased or were one's own.
Why does the account-purchasing segment alone constitute a separate offense?
Some may ask: buying a few accounts, how does that amount to infringing on another person's personal information?
The 2017 judicial interpretation issued by the Supreme People's Court and the Supreme People's Procuratorate answers this question through two provisions. The first defines what constitutes citizens' personal information, and account passwords are expressly listed within it:
Article 1: "Citizens' personal information" as provided in Article 253A of the Criminal Law refers to all kinds of information recorded electronically or by other means that can, alone or in combination with other information, identify a specific natural person's identity or reflect a specific natural person's activities, including name, ID document number, means of communication and contact, address, account password, property status, whereabouts and trajectories, etc.
A real-name-verified account simultaneously binds together a name, an ID number and an account password. Whether it counts as personal information—this provision has already indicated the direction.
The second provision is even more critical. The original wording of paragraph 3 is "stealing or otherwise unlawfully obtaining," which sounds like it is referring to hackers, but Article 4 of the interpretation delineates the scope of this opening:
Article 4: Obtaining citizens' personal information by purchasing, receiving, exchanging or other means in violation of state regulations, or collecting citizens' personal information in the course of performing duties or providing services, constitutes "otherwise unlawfully obtaining citizens' personal information" as provided in paragraph 3 of Article 253A of the Criminal Law.
The word "purchasing" ranks first. You do not need to pick a lock, you do not need to drag a database; the very act of paying money and buying it in is already the conduct the Criminal Law intends to punish. The price paid by the three individuals in the Jinzhong case was 20 to 50 yuan per item; the more readily the money was paid, the clearer the actus reus.
This is not a new rule. (2021) Jin 0110 Xing Chu No. 134, a final effective judgment of the People's Court of Jinyuan District, Taiyuan City: Shen purchased more than 2,000 WeChat accounts, conducted real-name verification, and resold them at a markup, profiting more than 200,000 yuan, constituting the crime of infringing on citizens' personal information; the judgment did not discuss at all whether WeChat accounts count as personal information and simply applied it directly. Shen was a seller of accounts and fell under paragraph 1; the three individuals in Jinzhong were buyers using the accounts themselves and fell under paragraph 3. Both ends of the buy-sell transaction, the same charge, the same set of conviction and sentencing standards. On this chain, there is no such thing as catching only the upstream seller and not the downstream buyer.
Seven thousand eight hundred accounts and 500,000 yuan correspond to a sentence of three to seven years
The notice only stated the charge and did not state the circumstances, but the judicial interpretation quantifies this matter very thoroughly, so you can calculate it yourself.
For ordinary account and password information, the criminalization threshold is 5,000 items:
(5) Illegally obtaining, selling, or providing 5,000 or more items of citizens' personal information other than that specified in Items 3 and 4;
In the Jinzhong case, more than 7,800 real-name authenticated accounts were verified, exceeding the threshold. Illegal gains of 5,000 yuan also independently constitute serious circumstances:
(7) Illegal gains of 5,000 yuan or more;
The three individuals made illegal profits of more than 500,000 yuan. What truly determines the weight of this case is the following provision:
(3) The quantity or amount reaches ten times or more the standards specified in Items 3 to 8 of the preceding paragraph;
This item constitutes especially serious circumstances. The ten-times threshold for illegal gains is 50,000 yuan, and more than 500,000 yuan is more than ten times that threshold. The conclusion is clear: the statutory sentencing range faced by the three individuals in Jinzhong is not fixed-term imprisonment of not more than three years, butfixed-term imprisonment of not less than three years but not more than seven years, and a fineUnder Article 12 of the Interpretation, the fine is not less than one time but not more than five times the illegal gains, corresponding to 500,000 to 2.5 million yuan.
The Shen case can serve as a reference: illegal gains of more than 200,000 yuan were likewise found to constitute especially serious circumstances, and a sentence of three years was imposed, precisely at the lower edge of the heavier range, and there were also two mitigating circumstances: voluntary confession and pleading guilty and accepting punishment. The illegal gains in the Jinzhong case are two and a half times his, and the number of accounts is close to four times his.
I would like to add a caution: the above is an estimate based on figures in public reports and the currently effective Interpretation, not a judgment. The case has not yet been heard, and neither the prosecuting authority nor the indictment case number has been made public; the final determination shall be subject to the court.
The narrow gate for lawful business operations, and several actions you should adjust
At this point, companies that genuinely produce content will probably breathe a sigh of relief: we don't fabricate rumors, so this case has nothing to do with us.
That is only half right. The judicial interpretation does leave a door open for lawful business operations, but that door is narrower than you think.
Article 6: Where a person, for the purpose of lawful business operations, unlawfully purchases or receives citizens' personal information other than that specified in Item 3 or Item 4 of Paragraph 1 of Article 5 of this Interpretation, and any of the following circumstances exists, it shall be determined to be "serious circumstances" as provided in Article 253A of the Criminal Law:
(1) the person profits 50,000 yuan or more by using the citizens' personal information unlawfully purchased or received;
Do you see the difference? Under Article 6, the criminalization threshold is a profit of 50,000 yuan, rather than the 5,000 items or 5,000 yuan under Article 5. For the same purchase of accounts, the two sets of standards differ by an order of magnitude.
The hinge of the door is the phrase "for the purpose of lawful business operations." If purchased accounts are used for normal content distribution, there is room to argue for this article; if they are used to fabricate rumors and obtain rebates, the purpose itself is unlawful, Article 6 does not apply, and the matter falls back to the stricter standard under Article 5. The three individuals in Jinzhong held more than 90 individual industrial and commercial households and more than 50 MCN institutions, with complete business registration and a more formal appearance than anyone else, yet this shell did not block Paragraph 3, and that is precisely why. Moreover, Paragraph 2 of Article 6 also expressly provides that where information purchased or received is subsequently sold or provided to others, Article 5 applies directly: even if the accounts were originally purchased for normal operations, once they are passed on to someone else, the wider opening closes immediately.
So what specifically should be adjusted?
For teams just starting out, the most important thing is not to buy accounts in bulk. Real-name accounts at twenty or thirty yuan each look cheap, but the cost is that each account purchased adds one more count to the criminal quantity, and 5,000 is the line. Accounts should either be registered under one's own real name or obtained through the platform's official institutional onboarding channel.
For MCNs and content companies that already have scale, the problem usually lies in the existing stock. For accounts that were historically affiliated through informal arrangements, whether their source can be clearly explained is the one thing that most needs to be inventoried right now. It is advisable to establish a source ledger for each account under management, noting the registration entity, the real-name individual, and the authorization documents. When the investigating authorities actually come knocking, accounts for which an authorization chain can be produced and those for which it cannot are entirely different in nature.
Article 11 of the Interpretation also provides that bulk information is directly determined according to the quantity seized, unless there is evidence proving that it is duplicative or inauthentic. What this sentence means is that the burden of proof is on you. The ledger is not formalism; it is the only thing that can reduce the count.
For upstream and downstream service providers engaged in agency operations, account trading, and MCN matchmaking, the risk is most easily underestimated. You may think you are merely an intermediary who does not touch the content, but the act of handling accounts itself falls within purchasing, receiving, and exchanging under Article 4. Contracts must clearly state the source and authorization of accounts, and verification records must be retained.
A word also for ordinary individuals. When you sell an idle real-name account for twenty or thirty yuan, what you sell is not just an account, but your identity bound to that account. What it will be used to post next, you can neither control nor necessarily explain clearly.
On the same production line, different sources of accounts lead to divergent legal consequences
Will downstream rumor-mongering be counted as a separate offense?
Finally, there is an unresolved question: will the negative articles fabricated by the three individuals using AI be counted separately as another offense?
At present, the publicly disclosed characterization involves only one charge. However, the Supreme People's Court issued a batch of typical cases on May 8 of this year, and the guidance was stated plainly: strengthen the crackdown on downstream associated crimes carried out using personal information, so that upstream crimes of stealing and trading personal information yield no profit.
Among that batch of cases, there were two examples of concurrent punishment for multiple crimes. In addition to illegally obtaining personal information, Lin also set up groups to carry out doxxing; he was sentenced to six years and six months for the crime of infringing on citizens' personal information and one year for the crime of illegally using information networks, with the sentences combined and executed as seven years. After illegally obtaining HPV vaccine appointment information, Liang carried out targeted fraud; he was sentenced to eleven years for fraud and three years and six months for the crime of infringing on citizens' personal information, with the sentences combined and executed as twelve years.
Some may invoke Article 8 of the Interpretation. That article does provide that where an act simultaneously constitutes the crime of infringing on citizens' personal information, conviction and punishment shall be in accordance with the crime of infringing on citizens' personal information. However, the boundary of that absorption rule is narrow; it targets only the segment concerning websites and groups established for the purpose of obtaining personal information. Where there is another independent crime downstream, the answer given by the Supreme People's Court is concurrent punishment, not absorption.
Following this line of reasoning, if the downstream rumor-mongering in the Jinzhong case is found to separately constitute the crime of damaging commercial reputation and product reputation, there is in theory room for concurrent punishment. This is probably the most noteworthy aspect of the first-instance proceedings. Three other points also merit attention: how many of the 7,800 accounts can be excluded, whether the RMB 1.6 million in platform revenue or the RMB 500,000 in illegal gains should serve as the calculation base, and how the respective status and role of the three individuals should be distinguished.
The judgment this case leaves for the content industry is actually quite simple. In the AI content business, everyone is accustomed to focusing compliance efforts on what is written: reviewing scripts, filtering sensitive words, and labeling generated content—all of which should be done. But the charges in the Jinzhong and Xi'an cases point to something else: what truly lands people in the three-to-seven-year range is not those articles, but where the accounts came from.
Content can be rectified, but the source of accounts cannot be reversed and redone.
Reference Sources
- Jinzhong Cybersecurity and Network Security Notice dated August 21, 2026 (reprinted by IT Home and Phoenix Technology)
- Interpretation of the Supreme People's Court and the Supreme People's Procuratorate on Several Issues Concerning the Application of Law in Handling Criminal Cases of Infringing on Citizens' Personal Information (Fa Shi [2017] No. 10), official website of the Supreme People's Procuratorate and official website of the Supreme People's Court
- Article 253A, Article 221, Article 287A and Article 293 of the Criminal Law of the People's Republic of China (2023 Amendment)
- Typical Cases of People's Courts Lawfully Punishing the Crime of Infringing on Citizens' Personal Information and Related Crimes, issued by the Supreme People's Court on May 8, 2026
- (2021) Jin 0110 Xing Chu No. 134, Criminal Judgment of the People's Court of Jinyuan District, Taiyuan City, China Judgments Online
- Xi'an Cyber Police notice of June 17, 2026 (republished by Chao News, National Business Daily and Shaanxi Piyao)
- Notice by the Changning Branch of the Shanghai Municipal Public Security Bureau on a case involving online rumors concerning enterprises (republished by The Beijing News, Guangming Online and People's Daily Online, May 2025)
Author:Lü Yinghui, a lawyer at Mankun (Shenzhen) Law Firm. A graduate of China University of Political Science and Law, with nearly ten years of experience in the legal industry, having previously worked at a court in Shenzhen. Focused on legal services in the new-generation economy, with extensive practical experience and deep insights in fields such as Web3 and artificial intelligence. Account across all platforms: Lao Lü Talks New Money; you are welcome to follow.
