On 1 June 2025, China’s Cyberspace Administration (CAC) brought into force the Measures for the Security Management of Face Recognition Technology Applications (the „Measures“). This landmark regulation is the first piece of dedicated legislation in China governing the use of biometric facial data, and it carries significant implications for any organization processing face recognition data within Chinese territory. Why Now? China already had a general legal framework in place. The Personal Information Protection Law (PIPL), the Data Security Law, the Cybersecurity Law, and the Network Data Security Regulations all touch on how personal and sensitive data should be handled. The Measures build directly on these, filling a gap with rules specifically designed for face recognition. Face recognition technology has quietly become part of everyday life in China. Airports and train stations use it for identity checks. Residential compounds and office buildings rely on it for access control. Banks and payment platforms deploy it to authenticate transactions. Public security agencies use it to track and identify suspects. All of this has brought real convenience. But it has also raised serious concerns. Unlike a password, facial data cannot be reset once it is leaked. The growing risk of identity fraud, unauthorized profiling, and covert surveillance eventually pushed regulators to act. Who Does This Apply To? According to Article 2 of the Measures, the regulation covers any entity or individual applying face recognition technology to process facial information within mainland China. There is one notable exception. Organizations doing research and development or algorithm training with facial data are not covered by the Measures, though they still have to comply with PIPL and other relevant laws. That said, once the technology moves from the lab into a real-world application, full compliance obligations apply. The Core Compliance Requirements - Mandatory Disclosure (Article 5): Before collecting