China operates the world’s most extensive system of internet censorship, combining sweeping laws, a technical filtering apparatus commonly called the Great Firewall, mandatory real-name registration, and legal duties that force companies to police content and share data with the state. The underlying idea is “cyber sovereignty”: the government treats the internet inside its borders the same way it treats physical territory, and asserts full authority over what moves through it.
The Laws Behind the System
Three statutes do most of the work. The Cybersecurity Law, effective June 1, 2017, is the foundation. It sets network security duties, establishes data protection requirements, and gives the state authority to compel companies to cooperate with security investigations.1DigiChina. Cybersecurity Law of the People’s Republic of China It was amended in October 2025 to add provisions on artificial intelligence.2Center for Security and Emerging Technology. Cybersecurity Law of the People’s Republic of China
The Data Security Law, effective September 2021, sorts data into tiers based on its importance to national security and the economy. Companies handling data the government designates as “important” must run regular risk assessments and report to regulators. Penalties for serious failures reach 2 million yuan and, at the extreme end, loss of a business license.3Supreme People’s Procuratorate of the People’s Republic of China. Data Security Law of the People’s Republic of China
The Personal Information Protection Law, effective November 2021, is China’s closest analog to Europe’s GDPR. It governs collection, storage, and transfer of personal data and requires explicit consent for sensitive processing. For grave violations, fines can reach 50 million yuan or 5 percent of the previous year’s revenue, whichever is higher. Individual executives responsible for the breach can be personally fined between 100,000 and 1 million yuan.
Enforcement is concentrated in the Cyberspace Administration of China, which has grown from its 2011 role managing online content into what analysts describe as a “supra-ministerial” regulator with reach across nearly every online sector.4DigiChina. Behind the Facade of China’s Cyber Super-Regulator The CAC handles content regulation, approves cross-border data transfers, and receives mandatory breach reports. The Ministry of Industry and Information Technology licenses telecom operators and mobile applications, and the two bodies work in tandem.5The US-China Business Council. Cyberspace Administration of China
How the Great Firewall Filters Traffic
The Great Firewall is not one tool but a stack of them, each aimed at a different layer of internet traffic.
Blocking Addresses and Poisoning Lookups
At the network level, blacklisted IP addresses are injected into the routing protocol used by every Chinese internet service provider, forcing routers to drop traffic bound for prohibited servers. The blacklists update constantly.
DNS tampering works alongside it. When a browser asks a DNS server to translate a website name into its numerical address, the firewall intercepts the query and returns a false answer, sending the browser toward a nonexistent or wrong server. Other DNS servers inside China then cache the fake answer, spreading the block automatically.
Reading the Contents of Packets
Deep packet inspection goes beyond addresses and examines the actual contents of data crossing the network border. If the system spots a blacklisted keyword in an HTTP request, it injects forged reset packets to both ends of the connection, killing it. Then, for up to several hours, it drops everything else between those two endpoints. URL filtering runs alongside this, letting the system block individual pages or subdirectories rather than whole domains, so a site may partially load while specific pages fail silently.
Hunting VPNs and Encrypted Tunnels
Machine learning algorithms analyze traffic patterns to spot connections that look like VPN tunnels even when the contents are encrypted. When the system flags a suspected tunnel, it drops the packets. For tools like Tor, the firewall runs real-time active probing, opening its own connections to suspected relay servers to confirm what they are and shut them down, often within seconds.
On domestic platforms, AI-driven filters scan text, images, and video for sensitive material and its common workarounds, recognizing slang, homophones, and altered images that users craft to slip past keyword lists.
What’s Blocked and What Replaces It
Most of the global internet’s largest platforms are inaccessible inside China without circumvention tools. Google’s entire suite, including Search, Gmail, YouTube, and Maps, has been blocked since 2014. Facebook, Instagram, and WhatsApp are unavailable. So are Twitter (X), Snapchat, Telegram, and Signal. Wikipedia is blocked in all languages. Major Western outlets including the New York Times, Wall Street Journal, Bloomberg, and The Economist cannot be reached. Netflix and Vimeo are unavailable. More recently, ChatGPT and other Western AI tools have been added to the list.
Chinese users rely on domestic alternatives that operate under direct regulatory oversight. WeChat handles messaging, social media, and payments for over a billion users. Weibo is the microblogging equivalent. Baidu dominates search. Douyin, Bilibili, and Youku fill the space of YouTube and Western streaming.
Beyond blocking foreign platforms, domestic services actively remove content. Political criticism and organized dissent are the highest priorities, along with material contradicting official accounts of events such as the Tiananmen Square protests and content about Taiwanese sovereignty, Tibetan independence, or Uyghur rights. The scope also covers pornography, online gambling, content promoting “excessive wealth,” religious material from organizations not recognized by the state, and entertainment with themes the government deems sensitive.
Real-Name Registration and User Surveillance
Every user’s online activity is tied to a verified legal identity. Real-name registration has been required for online services since 2012, when the Standing Committee of the National People’s Congress adopted rules requiring users to disclose their identity to providers for phone service, internet access, and social media.6Wikipedia. Internet Real-Name System in China In practice, using almost any online service requires a government-issued ID number or a verified mobile phone number.
The verification chain begins at the hardware layer. Since December 2019, buying a SIM card in China requires a facial recognition scan at the point of sale, so the phone number used for online registration also traces back to a specific face. Comments, purchases, and private messages can be linked to individuals. Monitoring software embedded in domestic apps tracks user behavior and flags interactions the system considers suspicious.
Rules Companies Must Follow
Any company operating in China’s digital market is directly responsible for the content on its platform. That means monitoring proactively and deleting prohibited material almost as soon as it appears, not waiting for the government to flag it. Refusal to provide technical support to public security or national security agencies triggers escalating fines that reach 1 million yuan for serious cases under the revised Cybersecurity Law.7China Law Translate. Cybersecurity Law of the People’s Republic of China (2026 Revised Version) The practical result: data stored on Chinese servers, including encrypted data, is potentially available to the government on request.
Data Localization
Critical information infrastructure operators that collect personal information or “important data” inside China must store it on servers physically located in the country. Transferring that data abroad requires passing a security assessment run by the CAC.1DigiChina. Cybersecurity Law of the People’s Republic of China Foreign companies that need local data infrastructure generally partner with Chinese entities, since direct foreign ownership is heavily restricted.
Cross-Border Data Transfers
Moving personal data out of China requires one of several compliance pathways depending on volume and sensitivity. Organizations that have processed data from more than 1 million individuals, or transferred the sensitive personal information of 10,000 or more people since January 1 of the previous year, must undergo a mandatory CAC security assessment.
Smaller transfers can use a government-published standard contract, but only if the organization is not a critical infrastructure operator, has processed data from fewer than 1 million individuals, has transferred personal information of fewer than 100,000 individuals since January 1 of the prior year, and has transferred sensitive personal information of fewer than 10,000 individuals in the same period. The contract’s terms cannot be modified, and the signed version must be filed with the CAC.
The rules define “transfer” broadly. Storing data on an overseas server, letting a foreign parent company query a Chinese database, or making data available for download by an overseas recipient all count. Splitting data into smaller batches to stay under the assessment thresholds is explicitly prohibited.
App Registration
Since 2024, all mobile applications and WeChat Mini Programs distributed in China must complete a filing with MIIT before going live. Apps that skip the step cannot be hosted on domestic app stores, and distribution platforms, network access providers, and device manufacturers are prohibited from working with unregistered apps. Without the filing, there is no legal path to Chinese users.
Breach Reporting
As of January 1, 2026, companies that discover a cybersecurity incident meeting the CAC’s severity thresholds must file an initial report with their provincial CAC office within four hours, in Chinese. Severe or extremely severe incidents must then be escalated to the national CAC within one additional hour.
Using a VPN in China
Using unauthorized VPN services to bypass the Great Firewall is legally restricted under rules dating to 1996, which authorize fines of up to 15,000 yuan for using unauthorized channels for international networking. Enforcement has been inconsistent. Some people receive fines of only a few hundred yuan; others have been detained for several days. Police have broad discretion. The risk falls more heavily on people using circumvention tools to reach or share politically sensitive content than on someone quietly checking a foreign email service, but the legal exposure exists either way.
For companies, legal cross-border connectivity is not a matter of installing a commercial VPN. It requires registering through one of three state-approved telecom providers: China Telecom, China Unicom, or China Mobile. The connection must use approved protocols, block prohibited content, and be used only for internal business, with extensive documentation and ongoing compliance monitoring.
What This Means for Foreign Businesses
A 2022 investigation by the U.S. International Trade Commission found that nearly three-quarters of affected U.S. firms reported negative impacts on their ability to provide products and services in China. More than 40 percent said censorship-related measures raised their costs or caused lost revenue, and almost 40 percent reported self-censoring their own content to keep market access.8U.S. International Trade Commission. Censorship-Related Measures in China Cause Significant Annual Costs
Data localization, content compliance, mandatory partnerships with local entities, app registration, and restricted cross-border connectivity together mean that operating in China’s digital economy demands a fundamentally different infrastructure and compliance posture than operating anywhere else.